CVE-2021-3971 Privilege escalation in Notebook BIOS
An attacker with elevated privileges can modify firmware protection regions via NVRAM variables in Lenovo Notebook BIOS due to a leftover manufacturing driver.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3971?
CVE-2021-3971 is a medium-severity vulnerability in Lenovo Notebook BIOS, published on 22 Apr 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.
Weakness: CWE-489
Which versions are affected by CVE-2021-3971?
It affects 73 products.
Products include Lenovo Ideapad 3-14ada05 Firmware, Lenovo Ideapad 3-14ada6 Firmware, Lenovo Ideapad 3-14alc6 Firmware, Lenovo Ideapad 3-14are05 Firmware, Lenovo Ideapad 3-14igl05 Firmware, Lenovo Ideapad 3-14iil05 Firmware and 67 more.
How do I fix CVE-2021-3971?
No fix has been published for CVE-2021-3971 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-3971 being exploited?
There is no known exploitation of CVE-2021-3971 in the wild and no public exploit code.
Other vulnerabilities in Lenovo Notebook BIOS
Sources
Also known as GHSA-v9mm-m35w-j8fm.