Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-3718: A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

CVE-2021-3718 · published 4 years ago

Summary

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

What to do

Update lenovo thinkpad_l14_gen_1_firmware to version 1.15 or later.
Update lenovo thinkpad_l14_firmware to version 1.20.1.17 or later.
Update lenovo thinkpad_l15_gen_1_firmware to version 1.15 or later.
Update lenovo thinkpad_l15_firmware to version 1.20.1.17 or later.
Update lenovo thinkpad_l490_firmware to version 1.26 or later.
Update lenovo thinkpad_l590_firmware to version 1.26 or later.
Update lenovo thinkpad_p43s_firmware to version n2iet96w or later.
Update lenovo thinkpad_p52_firmware to version n2cet60w or later.
Update lenovo thinkpad_p53s_firmware to version n2iet96w or later.
Update lenovo thinkpad_p72_firmware to version n2cet60w or later.
Update lenovo thinkpad_t490_firmware to version n2iet96w or later.
Update lenovo thinkpad_t590_firmware to version n2iet96w or later.
Update lenovo thinkpad_x12_detachable_gen_1_firmware to version 1.16 or later.
Update lenovo thinkpad_x390_yoga_firmware to version n2let87w or later.

Affected software

Vendor	Product	Affected versions
lenovo	thinkpad_11e_3rd_gen_firmware	<= 1.22 <= 1.29 `cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:::::braswell:::*`
lenovo	thinkpad_11e_4th_gen_i3_firmware	<= 1.22 `cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i3_firmware::::::::`
lenovo	thinkpad_11e_4th_gen_i7_firmware	<= 1.22 `cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i7_firmware::::::::`
lenovo	thinkpad_11e_4th_gen_i5_firmware	<= 1.22 `cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i5_firmware::::::::`
lenovo	thinkpad_11e_4th_gen_celeron_firmware	<= 1.27 `cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_celeron_firmware::::::::`
lenovo	thinkpad_11e_yoga_gen_6_firmware	<= 1.12 `cpe:2.3:o:lenovo:thinkpad_11e_yoga_gen_6_firmware::::::::`
lenovo	thinkpad_13_gen_2_firmware	<= 1.29 `cpe:2.3:o:lenovo:thinkpad_13_gen_2_firmware::::::::`
lenovo	thinkpad_e490_firmware	<= 1.30 `cpe:2.3:o:lenovo:thinkpad_e490_firmware::::::::`
lenovo	thinkpad_e490s_firmware	<= 1.30 `cpe:2.3:o:lenovo:thinkpad_e490s_firmware::::::::`
lenovo	thinkpad_e590_firmware	<= 1.30 `cpe:2.3:o:lenovo:thinkpad_e590_firmware::::::::`
lenovo	thinkpad_l13_firmware	<= 1.31 `cpe:2.3:o:lenovo:thinkpad_l13_firmware::::::::`
lenovo	thinkpad_l13_gen_2_firmware	<= 1.11 <= 1.08 `cpe:2.3:o:lenovo:thinkpad_l13_gen_2_firmware:::::non-vpro:::*`
lenovo	thinkpad_l13_yoga_firmware	<= 1.31 `cpe:2.3:o:lenovo:thinkpad_l13_yoga_firmware::::::::`
lenovo	thinkpad_l13_yoga_gen_2_firmware	<= 1.11 <= 1.08 `cpe:2.3:o:lenovo:thinkpad_l13_yoga_gen_2_firmware:::::non-vpro:::*`
lenovo	thinkpad_l14_gen_1_firmware	< 1.15 `cpe:2.3:o:lenovo:thinkpad_l14_gen_1_firmware::::::::`
lenovo	thinkpad_l14_firmware	< 1.20.1.17 `cpe:2.3:o:lenovo:thinkpad_l14_firmware::::::::`
lenovo	thinkpad_l15_gen_1_firmware	< 1.15 `cpe:2.3:o:lenovo:thinkpad_l15_gen_1_firmware::::::::`
lenovo	thinkpad_l15_firmware	< 1.20.1.17 `cpe:2.3:o:lenovo:thinkpad_l15_firmware::::::::`
lenovo	thinkpad_l380_firmware	<= 1.26 `cpe:2.3:o:lenovo:thinkpad_l380_firmware::::::::`
lenovo	thinkpad_l380_yoga_firmware	<= 1.26 `cpe:2.3:o:lenovo:thinkpad_l380_yoga_firmware::::::::`
lenovo	thinkpad_l390_yoga_firmware	<= 1.35 `cpe:2.3:o:lenovo:thinkpad_l390_yoga_firmware::::::::`
lenovo	thinkpad_l390_firmware	<= 1.35 `cpe:2.3:o:lenovo:thinkpad_l390_firmware::::::::`
lenovo	thinkpad_l490_firmware	< 1.26 `cpe:2.3:o:lenovo:thinkpad_l490_firmware::::::::`
lenovo	thinkpad_l590_firmware	< 1.26 `cpe:2.3:o:lenovo:thinkpad_l590_firmware::::::::`
lenovo	thinkpad_p43s_firmware	< n2iet96w `cpe:2.3:o:lenovo:thinkpad_p43s_firmware::::::::`
lenovo	thinkpad_p52_firmware	< n2cet60w `cpe:2.3:o:lenovo:thinkpad_p52_firmware::::::::`
lenovo	thinkpad_p53s_firmware	< n2iet96w `cpe:2.3:o:lenovo:thinkpad_p53s_firmware::::::::`
lenovo	thinkpad_p72_firmware	< n2cet60w `cpe:2.3:o:lenovo:thinkpad_p72_firmware::::::::`
lenovo	thinkpad_s5_2nd_gen_firmware	<= 1.28 `cpe:2.3:o:lenovo:thinkpad_s5_2nd_gen_firmware::::::::`
lenovo	thinkpad_t460_firmware	<= 1.43.1.11 `cpe:2.3:o:lenovo:thinkpad_t460_firmware::::::::`
lenovo	thinkpad_t490_firmware	< n2iet96w `cpe:2.3:o:lenovo:thinkpad_t490_firmware::::::::`
lenovo	thinkpad_t590_firmware	< n2iet96w `cpe:2.3:o:lenovo:thinkpad_t590_firmware::::::::`
lenovo	thinkpad_s2_gen_6_firmware	<= 2021-09-30 `cpe:2.3:o:lenovo:thinkpad_s2_gen_6_firmware::::::::`
lenovo	thinkpad_s2_yoga_gen_6_firmware	<= 2021-09-30 `cpe:2.3:o:lenovo:thinkpad_s2_yoga_gen_6_firmware::::::::`
lenovo	thinkpad_x12_detachable_gen_1_firmware	< 1.16 `cpe:2.3:o:lenovo:thinkpad_x12_detachable_gen_1_firmware::::::::`
lenovo	thinkpad_x260_firmware	<= 1.47\/1.15 `cpe:2.3:o:lenovo:thinkpad_x260_firmware::::::::`
lenovo	thinkpad_x380_yoga_firmware	<= 1.34 `cpe:2.3:o:lenovo:thinkpad_x380_yoga_firmware::::::::`
lenovo	thinkpad_x390_yoga_firmware	< n2let87w `cpe:2.3:o:lenovo:thinkpad_x390_yoga_firmware::::::::`
lenovo	thinkpad_11e_5th_gen_firmware	<= 1.13 `cpe:2.3:o:lenovo:thinkpad_11e_5th_gen_firmware::::::::`

Original advisory text

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

References

https://support.lenovo.com/us/en/product_security/LEN-72619 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.6 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-232Improper Handling of Undefined Values

Timeline

Published12 Nov 2021

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2021-3718 · NVD

Track software like this

Free during beta