CVE-2020-8333 Code injection in BIOS
A vulnerability in the Lenovo BIOS EEPROM driver allows arbitrary code execution via a malicious SMI callback.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8333?
CVE-2020-8333 is a medium-severity code injection vulnerability in Lenovo BIOS, published on 24 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execution
Which versions are affected by CVE-2020-8333?
It affects 27 products.
Products include Lenovo 63 Firmware, Lenovo H50-30g Firmware, Lenovo M4500 Firmware, Lenovo M4550 Firmware, Lenovo Qitian 4500 Firmware, Lenovo Qitian B4550 Firmware and 21 more.
How do I fix CVE-2020-8333?
No fix has been published for CVE-2020-8333 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-8333 being exploited?
There is no known exploitation of CVE-2020-8333 in the wild and no public exploit code.
Other vulnerabilities in Lenovo BIOS
Sources
Also known as GHSA-2vg7-q8hg-5f79.