Strix
26.1K

CVE-2016-8222

UnknownEPSS 0.30%

Last modified

CVE-2016-8222 is a vulnerability of currently unknown severity. A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). EPSS estimates a 0.30% chance of exploitation in the next 30 days.

Description

A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.

Metrics

EPSS Probability
0.30%

21.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LenovoThinkpad 10 Ella 2 BiosAll versions
LenovoThinkpad 11e Beema BiosAll versions
LenovoThinkpad 11e Braswell BiosAll versions
LenovoThinkpad 11e Broadwell BiosAll versions
LenovoThinkpad 11e Skylake BiosAll versions
LenovoThinkpad 13e BiosAll versions
LenovoThinkpad E450 BiosAll versions
LenovoThinkpad E450c BiosAll versions
LenovoThinkpad E455 BiosAll versions
LenovoThinkpad E460 BiosAll versions
LenovoThinkpad E465 BiosAll versions
LenovoThinkpad E550 BiosAll versions
LenovoThinkpad E550c BiosAll versions
LenovoThinkpad E555 BiosAll versions
LenovoThinkpad E560 BiosAll versions
LenovoThinkpad E565 BiosAll versions
LenovoThinkpad Edge E440 BiosAll versions
LenovoThinkpad Edge E445 BiosAll versions
LenovoThinkpad Edge E540 BiosAll versions
LenovoThinkpad Edge E545 BiosAll versions
LenovoThinkpad Helix 20cg BiosAll versions
LenovoThinkpad Helix 20ch BiosAll versions
LenovoThinkpad L440 BiosAll versions
LenovoThinkpad L450 BiosAll versions
LenovoThinkpad L460 BiosAll versions
LenovoThinkpad L540 BiosAll versions
LenovoThinkpad L560 BiosAll versions
LenovoThinkpad P50 BiosAll versions
LenovoThinkpad P50s BiosAll versions
LenovoThinkpad P70 BiosAll versions
LenovoThinkpad S1 Yoga 12 BiosAll versions
LenovoThinkpad S1 Yoga Non Vpro BiosAll versions
LenovoThinkpad S1 Yoga Vpro BiosAll versions
LenovoThinkpad S3 S440 BiosAll versions
LenovoThinkpad S3 Yoga 14 BiosAll versions
LenovoThinkpad S5 E560p BiosAll versions
LenovoThinkpad S5 Yoga 15 BiosAll versions
LenovoThinkpad S540 BiosAll versions
LenovoThinkpad T440 BiosAll versions
LenovoThinkpad T440p BiosAll versions
LenovoThinkpad T440s BiosAll versions
LenovoThinkpad T440u BiosAll versions
LenovoThinkpad T450 BiosAll versions
LenovoThinkpad T450s BiosAll versions
LenovoThinkpad T460 BiosAll versions
LenovoThinkpad T460p BiosAll versions
LenovoThinkpad T460s BiosAll versions
LenovoThinkpad T540 BiosAll versions
LenovoThinkpad T540p BiosAll versions
LenovoThinkpad T550 BiosAll versions

Showing 50 of 74 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2016-8222?
A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.
How severe is CVE-2016-8222?
Severity scoring for CVE-2016-8222 is pending analysis. The EPSS model estimates a 0.30% probability of exploitation in the next 30 days.
How do I fix CVE-2016-8222?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-8222?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST