CVE-2021-3718 | ByteOS Network

Vulnerability Details :

CVE-2021-3718

Assigner-lenovo

Assigner Org ID-da227ddf-6e25-4b41-b023-0f976dcaca4b

Published At-12 Nov, 2021 | 22:05

Updated At-03 Aug, 2024 | 17:01

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:lenovo

Assigner Org ID:da227ddf-6e25-4b41-b023-0f976dcaca4b

Published At:12 Nov, 2021 | 22:05

Updated At:03 Aug, 2024 | 17:01

▼CVE Numbering Authority (CNA)

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

Affected Products

Vendor

Lenovo Group Limited

Product

Versions

Affected

various

Problem Types

Type	CWE ID	Description
CWE	CWE-232	CWE-232 Improper Handling of Undefined Values

Type: CWE

CWE ID: CWE-232

Description: CWE-232 Improper Handling of Undefined Values

Metrics

Version	Base score	Base severity	Vector
3.1	4.3	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Solutions

Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-72619.

Credits

Lenovo thanks Zoltan Harmarth for reporting this issue

References

Hyperlink	Resource
https://support.lenovo.com/us/en/product_security/LEN-72619	x_refsource_MISC

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-72619

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://support.lenovo.com/us/en/product_security/LEN-72619	x_refsource_MISC x_transferred

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-72619

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@lenovo.com

Published At:12 Nov, 2021 | 22:15

Updated At:23 Nov, 2021 | 14:50

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	4.6	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Secondary	3.1	4.3	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary	2.0	4.7	MEDIUM	AV:L/AC:M/Au:N/C:N/I:N/A:C

Type: Primary

Version: 3.1

Base score: 4.6

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Secondary

Version: 3.1

Base score: 4.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Type: Primary

Version: 2.0

Base score: 4.7

Base severity: MEDIUM

Vector:

AV:L/AC:M/Au:N/C:N/I:N/A:C

CPE Matches

Lenovo Group Limited

>>thinkpad_11e_3rd_gen>>-

cpe:2.3:h:lenovo:thinkpad_11e_3rd_gen:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

Microsoft Corporation

cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:x64:*

Microsoft Corporation

>>windows_8.1>>-

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_3rd_gen_firmware>>Versions up to 1.22(inclusive)

cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:*:*:*:*:braswell:*:*:*

Lenovo Group Limited

>>thinkpad_11e_3rd_gen>>-

cpe:2.3:h:lenovo:thinkpad_11e_3rd_gen:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

Microsoft Corporation

cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:x64:*

Microsoft Corporation

>>windows_8.1>>-

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_3rd_gen_firmware>>Versions up to 1.29(inclusive)

cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:*:*:*:*:skylate:*:*:*

Lenovo Group Limited

>>thinkpad_11e_4th_gen_i3>>-

cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i3:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_4th_gen_i3_firmware>>Versions up to 1.22(inclusive)

cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i3_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_4th_gen_i7>>-

cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i7:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_4th_gen_i7_firmware>>Versions up to 1.22(inclusive)

cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i7_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_4th_gen_i5>>-

cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_i5:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_4th_gen_i5_firmware>>Versions up to 1.22(inclusive)

cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i5_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_4th_gen_celeron>>-

cpe:2.3:h:lenovo:thinkpad_11e_4th_gen_celeron:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_11e_4th_gen_celeron_firmware>>Versions up to 1.27(inclusive)

cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_celeron_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_11e_yoga_gen_6>>-

cpe:2.3:h:lenovo:thinkpad_11e_yoga_gen_6:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_11e_yoga_gen_6_firmware>>Versions up to 1.12(inclusive)

cpe:2.3:o:lenovo:thinkpad_11e_yoga_gen_6_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_13_gen_2>>-

cpe:2.3:h:lenovo:thinkpad_13_gen_2:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_13_gen_2_firmware>>Versions up to 1.29(inclusive)

cpe:2.3:o:lenovo:thinkpad_13_gen_2_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_e490_firmware>>Versions up to 1.30(inclusive)

cpe:2.3:o:lenovo:thinkpad_e490_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_e490>>-

cpe:2.3:h:lenovo:thinkpad_e490:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_e490s_firmware>>Versions up to 1.30(inclusive)

cpe:2.3:o:lenovo:thinkpad_e490s_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_e490s>>-

cpe:2.3:h:lenovo:thinkpad_e490s:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_e590_firmware>>Versions up to 1.30(inclusive)

cpe:2.3:o:lenovo:thinkpad_e590_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_e590>>-

cpe:2.3:h:lenovo:thinkpad_e590:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_l13_firmware>>Versions up to 1.31(inclusive)

cpe:2.3:o:lenovo:thinkpad_l13_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_l13>>-

cpe:2.3:h:lenovo:thinkpad_l13:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_l13_gen_2_firmware>>Versions up to 1.11(inclusive)

cpe:2.3:o:lenovo:thinkpad_l13_gen_2_firmware:*:*:*:*:non-vpro:*:*:*

Lenovo Group Limited

>>thinkpad_l13_gen_2>>-

cpe:2.3:h:lenovo:thinkpad_l13_gen_2:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_l13_gen_2_firmware>>Versions up to 1.08(inclusive)

cpe:2.3:o:lenovo:thinkpad_l13_gen_2_firmware:*:*:*:*:vpro:*:*:*

Lenovo Group Limited

>>thinkpad_l13_gen_2>>-

cpe:2.3:h:lenovo:thinkpad_l13_gen_2:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_l13_yoga_firmware>>Versions up to 1.31(inclusive)

cpe:2.3:o:lenovo:thinkpad_l13_yoga_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkpad_l13_yoga>>-

cpe:2.3:h:lenovo:thinkpad_l13_yoga:-:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_10>>-

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*

Lenovo Group Limited

>>thinkpad_l13_yoga_gen_2_firmware>>Versions up to 1.11(inclusive)

cpe:2.3:o:lenovo:thinkpad_l13_yoga_gen_2_firmware:*:*:*:*:non-vpro:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-232	Secondary	psirt@lenovo.com

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-232

Type: Secondary

Source: psirt@lenovo.com

References

Hyperlink	Source	Resource
https://support.lenovo.com/us/en/product_security/LEN-72619	psirt@lenovo.com	Vendor Advisory

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-72619

Source: psirt@lenovo.com

Resource:

Vendor Advisory