CVE-2020-8341
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this...
CVE-2020-8341 is a low vulnerability (CVSS 2.4) in Lenovo Thinkpad, published September 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. No source names a fixed version.
- Severity
- 2.4 LowCVSS 3.1, NVD
- Exploit chance
- 0.35%EPSS, 28th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
- lenovo thinkpad
- lenovo thinkpad t490 \(20nx\) firmware
- lenovo thinkpad t490 \(20qx\) firmware
- lenovo thinkpad t490 \(20rx\) firmware
- lenovo thinkpad t490s \(20nx\) firmware
- lenovo thinkpad t495 drift firmware
- lenovo thinkpad t590 \(20nx\) firmware
- lenovo thinkpad x1 carbon \(20qx\) firmware
- lenovo thinkpad x1 yoga \(20qx\) firmware
- lenovo thinkpad x390 \(20qx\) firmware
- lenovo thinkpad x390 \(20sx\) firmware
What each source reports
NVD Score used
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
- Record
CVE-2020-8341- CVSS 3.1
- 2.4 Low
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
- Record
CVE-2020-8341- Updated
- 2026-11-02
EUVDEUVD-2020-29208No score
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
- Record
EUVD-2020-29208- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f46h-7c54-hvw7No score
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this...
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
- Record
GHSA-f46h-7c54-hvw7- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.