CVE-2020-8341
LOWLenovo ThinkPad T490/T490s/T495/T590/X1 Carbon/X1 Yoga/X390 - Insufficient SPI Flash Protection After S3 Sleep Resume
Title source: llmDescription
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_misc
https://support.lenovo.com/us/en/product_security/LEN-30042
Scores
CVSS v3
2.4
EPSS
0.0006
EPSS Percentile
18.1%
Attack Vector
PHYSICAL
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Details
Status
published
Products (10)
lenovo/thinkpad_t490_\(20nx\)_firmware
< n2iet90w
lenovo/thinkpad_t490_\(20qx\)_firmware
< n2iet90w
lenovo/thinkpad_t490_\(20rx\)_firmware
< n2ret16w
lenovo/thinkpad_t490s_\(20nx\)_firmware
< n2jet89w
lenovo/thinkpad_t495_drift_firmware
< 2020-08-30
lenovo/thinkpad_t590_\(20nx\)_firmware
< n2iet90w
lenovo/thinkpad_x1_carbon_\(20qx\)_firmware
< n2het54w
lenovo/thinkpad_x1_yoga_\(20qx\)_firmware
< n2het54w
lenovo/thinkpad_x390_\(20qx\)_firmware
< n2jet89w
lenovo/thinkpad_x390_\(20sx\)_firmware
< n2set18w
Published
Sep 01, 2020
Tracked Since
Feb 18, 2026