CVE-2021-3843: Input Validation
Published Nov 12, 2021
·Updated
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Affected Software
62 affected components
Lenovo Thinkpad 11e 3rd Gen Firmware<=1.22
Lenovo Thinkpad 11e 3rd Gen
Lenovo Thinkpad 11e 3rd Gen Firmware<=1.29
Lenovo Thinkpad 11e 4th Gen I3 Firmware<=1.22
Lenovo Thinkpad 11e 4th Gen I3
Lenovo Thinkpad 11e 4th Gen I7 Firmware<=1.22
Lenovo Thinkpad 11e 4th Gen I7
Lenovo Thinkpad 11e 4th Gen I5 Firmware<=1.22
Lenovo Thinkpad 11e 4th Gen I5
Lenovo Thinkpad 11e 4th Gen Celeron Firmware<=1.27
Lenovo Thinkpad 11e 4th Gen Celeron
Lenovo Thinkpad 11e Yoga Gen 6 Firmware<=1.12
Lenovo Thinkpad 11e Yoga Gen 6
Lenovo Thinkpad 13 Gen 2 Firmware<=1.29
Lenovo Thinkpad 13 Gen 2
Lenovo Thinkpad L13 Firmware<=1.31
Lenovo Thinkpad L13
Lenovo Thinkpad L13 Gen 2 Firmware<=1.11
Lenovo Thinkpad L13 Gen 2
Lenovo Thinkpad L13 Gen 2 Firmware<=1.08
Lenovo Thinkpad L13 Yoga Firmware<=1.31
Lenovo Thinkpad L13 Yoga
Lenovo Thinkpad L13 Yoga Gen 2 Firmware<=1.11
Lenovo Thinkpad L13 Yoga Gen 2
Lenovo Thinkpad L13 Yoga Gen 2 Firmware<=1.08
Lenovo Thinkpad L14 Gen 1 Firmware<1.15
Lenovo Thinkpad L14 Gen 1
Lenovo Thinkpad L14 Firmware<1.20.1.17
Lenovo Thinkpad L14
Lenovo Thinkpad L15 Gen 1 Firmware<1.15
Lenovo Thinkpad L15 Gen 1
Lenovo Thinkpad L15 Firmware<1.20.1.17
Lenovo Thinkpad L15
Lenovo Thinkpad L380 Firmware<=1.26
Lenovo Thinkpad L380
Lenovo Thinkpad L380 Yoga Firmware<=1.26
Lenovo Thinkpad L380 Yoga
Lenovo Thinkpad L390 Yoga Firmware<=1.35
Lenovo Thinkpad L390 Yoga
Lenovo Thinkpad L390 Firmware<=1.35
Lenovo Thinkpad L390
Lenovo Thinkpad S5 2nd Gen Firmware<=1.28
Lenovo Thinkpad S5 2nd Gen
Lenovo Thinkpad T460 Firmware<=1.43.1.11
Lenovo ThinkPad T460
Lenovo Thinkpad S2 Gen 6 Firmware<=2021-09-30
Lenovo Thinkpad S2 Gen 6
Lenovo Thinkpad S2 Yoga Gen 6 Firmware<=2021-09-30
Lenovo Thinkpad S2 Yoga Gen 6
Lenovo Thinkpad X12 Detachable Gen 1 Firmware<1.16
Lenovo Thinkpad X12 Detachable Gen 1
Lenovo Thinkpad X260 Firmware<=1.47\/1.15
Lenovo Thinkpad X260
Lenovo Thinkpad X380 Yoga Firmware<=1.34
Lenovo Thinkpad X380 Yoga
Lenovo Thinkpad X390 Yoga Firmware<n2let87w
Lenovo Thinkpad X390 Yoga
Lenovo Thinkpad 11e 5th Gen Firmware<=1.13
Lenovo Thinkpad 11e 5th Gen
Lenovo Thinkpad Yoga 370
Lenovo Thinkpad X1 Fold Gen 1 Firmware<n2pet50w
Lenovo Thinkpad X1 Fold Gen 1
Remediation
Information
Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-72619.
Event History
Nov 12, 2021
CVE Published
via MITRE·10:05 PM
Data Sourced
via MITRE·10:05 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2021-3843?
The severity of CVE-2021-3843 is classified as high due to its potential for local code execution.
2
How do I fix CVE-2021-3843?
To fix CVE-2021-3843, you should update the firmware of affected Lenovo ThinkPad models to the latest version provided by Lenovo.
3
What models are affected by CVE-2021-3843?
The affected models include various Lenovo ThinkPad 11e, 4th Gen i3/i5/i7, 13 Gen 2, L13, L14, S2 Gen 6, T460, and more.
4
Can remote attackers exploit CVE-2021-3843?
No, CVE-2021-3843 requires local access and elevated privileges for exploitation.
5
Is there a workaround for CVE-2021-3843?
Currently, the recommended mitigation for CVE-2021-3843 is to apply the firmware update as there are no known workarounds available.