Read the docs
TI-2020-06732 Aliases CVE-2020-8332GHSA-5pp7-xmxh-rxh5

Time-of-check time-of-use race condition in Lenovo System x

Priority LOW 28CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.

Why it matters now

EPSS 0.0023 13th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoSystem xvarious—No fix listedCNA
IBMSystem xvarious—No fix listedCNA
  • System x VendorLenovo Affected various Fixed in — No fix listed CNA
  • System x VendorIBM Affected various Fixed in — No fix listed CNA

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:o:lenovo:bladecenter_hs23_firmware:*:*:*:*:*:*:*:*before tke170bVulnerableLenovo
cpe:2.3:h:lenovo:bladecenter_hs23:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:bladecenter_hs23e_firmware:*:*:*:*:*:*:*:*before ahe172bVulnerableLenovo
cpe:2.3:h:lenovo:bladecenter_hs23e:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:compute_node-x440_firmware:*:*:*:*:*:*:*:*before cge128aVulnerableLenovo
cpe:2.3:h:lenovo:compute_node-x440:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:flex_system_x220_firmware:*:*:*:*:*:*:*:*before kse170bVulnerableLenovo
cpe:2.3:h:lenovo:flex_system_x220:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:flex_system_x240_firmware:*:*:*:*:*:*:*:*before b2e172bVulnerableLenovo
cpe:2.3:h:lenovo:flex_system_x240:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:bladecenter_hs23_firmware:*:*:*:*:*:*:*:* Versions before tke170b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:bladecenter_hs23:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:bladecenter_hs23e_firmware:*:*:*:*:*:*:*:* Versions before ahe172b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:bladecenter_hs23e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:compute_node-x440_firmware:*:*:*:*:*:*:*:* Versions before cge128a Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:compute_node-x440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:flex_system_x220_firmware:*:*:*:*:*:*:*:* Versions before kse170b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:flex_system_x220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:flex_system_x240_firmware:*:*:*:*:*:*:*:* Versions before b2e172b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:flex_system_x240:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:lenovo:flex_system_x440_firmware:*:*:*:*:*:*:*:*before cne172bVulnerableLenovo
cpe:2.3:h:lenovo:flex_system_x440:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:nextscale_nx360_m4_firmware:*:*:*:*:*:*:*:*before fhe132bVulnerableLenovo
cpe:2.3:h:lenovo:nextscale_nx360_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3300_m4_firmware:*:*:*:*:*:*:*:*before yae166bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3300_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3500_m4_firmware:*:*:*:*:*:*:*:*before y5e170bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3500_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3530_m4_firmware:*:*:*:*:*:*:*:*before bee174bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3530_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3550_m4_firmware:*:*:*:*:*:*:*:*before d7e174bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3550_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3630_m4_firmware:*:*:*:*:*:*:*:*before bee174bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3630_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3650_m4_firmware:*:*:*:*:*:*:*:*before vve172bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3650_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3650_m4_bd_firmware:*:*:*:*:*:*:*:*before vve172bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3650_m4_bd:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3650_m4_hd_firmware:*:*:*:*:*:*:*:*before vve172bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3650_m4_hd:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3750_m4_firmware:*:*:*:*:*:*:*:*before a5e130aVulnerableLenovo
cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3750_m4_firmware:*:*:*:*:*:*:*:*before koe170bVulnerableLenovo
cpe:2.3:o:lenovo:idataplex_dx360_m4_firmware:*:*:*:*:*:*:*:*before tde168bVulnerableLenovo
cpe:2.3:h:lenovo:idataplex_dx360_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:idataplex_dx360_m4_water_cooled_firmware:*:*:*:*:*:*:*:*before tde168bVulnerableLenovo
cpe:2.3:h:lenovo:idataplex_dx360_m4_water_cooled:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:flex_system_x440_firmware:*:*:*:*:*:*:*:* Versions before cne172b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:flex_system_x440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:nextscale_nx360_m4_firmware:*:*:*:*:*:*:*:* Versions before fhe132b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:nextscale_nx360_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3300_m4_firmware:*:*:*:*:*:*:*:* Versions before yae166b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3300_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3500_m4_firmware:*:*:*:*:*:*:*:* Versions before y5e170b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3500_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3530_m4_firmware:*:*:*:*:*:*:*:* Versions before bee174b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3530_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3550_m4_firmware:*:*:*:*:*:*:*:* Versions before d7e174b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3550_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3630_m4_firmware:*:*:*:*:*:*:*:* Versions before bee174b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3630_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3650_m4_firmware:*:*:*:*:*:*:*:* Versions before vve172b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3650_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3650_m4_bd_firmware:*:*:*:*:*:*:*:* Versions before vve172b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3650_m4_bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3650_m4_hd_firmware:*:*:*:*:*:*:*:* Versions before vve172b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3650_m4_hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3750_m4_firmware:*:*:*:*:*:*:*:* Versions before a5e130a Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3750_m4_firmware:*:*:*:*:*:*:*:* Versions before koe170b Vulnerable ·Lenovo
  • cpe:2.3:o:lenovo:idataplex_dx360_m4_firmware:*:*:*:*:*:*:*:* Versions before tde168b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:idataplex_dx360_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:idataplex_dx360_m4_water_cooled_firmware:*:*:*:*:*:*:*:* Versions before tde168b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:idataplex_dx360_m4_water_cooled:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8332
  2. 2026-10-03 Alias added: GHSA-5pp7-xmxh-rxh5

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences