CVE-2019-6156

Severity: low (CVSS 3.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-10 · updated 2026-06-17
Weakness: CWE-667

Description

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.

Affected products

Lenovo 330-14Igm Firmware: before 7xcn30ww — fixed in 7xcn30ww
Lenovo 330-15Igm Firmware: before 7xcn30ww — fixed in 7xcn30ww
Lenovo 510-15Ikl Firmware: all versions
Lenovo 510S-08Ikl Firmware: all versions
Lenovo 530S-07Icb Firmware: all versions
Lenovo Aio300-23Isu(C5130) Firmware: before o1lkt46a — fixed in o1lkt46a
Lenovo Aio520-22Ikl Firmware: all versions
Lenovo Aio520-22Iku Firmware: all versions
Lenovo Aio520-24Ikl Firmware: all versions
Lenovo Aio520-24Iku Firmware: all versions
Lenovo Aio520-27Ikl Firmware: all versions
Lenovo Aio 910-27Ish Firmware: before o37kt13a — fixed in o37kt13a
Lenovo Aio Y910-27Ish Firmware: all versions
Lenovo H50-30G Desktop Firmware: all versions
Lenovo Ideacentre 300-20Ish Firmware: all versions
Lenovo Ideacentre 300S-11Ish Firmware: all versions
Lenovo Ideacentre 510-15Icb Firmware: before o3qkt32a — fixed in o3qkt32a
Lenovo Ideacentre 510A-15Icb Firmware: before o3qkt32a — fixed in o3qkt32a
Lenovo Ideacentre 510S-08Ish Firmware: all versions
Lenovo Ideacentre 520S-23Iku Firmware: before o34kt23a — fixed in o34kt23a
Lenovo Ideacentre 620S-03Ikl Firmware: all versions
Lenovo Ideacentre 700 Firmware: before fwkt9aa — fixed in fwkt9aa
Lenovo Ideacentre 720-18Icb Firmware: before o3qkt32a — fixed in o3qkt32a
Lenovo Ideacentre 730S-24Ikb Firmware: before o3wkt15a — fixed in o3wkt15a
Lenovo Legion C530-19Icb Firmware: before o3lkt20a — fixed in o3lkt20a
Lenovo Legion C730-19Ico Firmware: before o3nkt20a — fixed in o3nkt20a
Lenovo Legion T530-28Icb Firmware: before o3lkt20a — fixed in o3lkt20a
Lenovo Legion T730-28Ico Firmware: before o3nkt20a — fixed in o3nkt20a
Lenovo Legion Y520T Z370 Firmware: all versions
Lenovo Legion Y720 Tower Firmware: all versions

How to fix

Upgrade to a fixed version: Lenovo 330-14Igm Firmware 7xcn30ww; Lenovo 330-15Igm Firmware 7xcn30ww; Lenovo Aio300-23Isu(C5130) Firmware o1lkt46a; Lenovo Aio 910-27Ish Firmware o37kt13a; Lenovo Ideacentre 510-15Icb Firmware o3qkt32a; Lenovo Ideacentre 510A-15Icb Firmware o3qkt32a; Lenovo Ideacentre 520S-23Iku Firmware o34kt23a; Lenovo Ideacentre 700 Firmware fwkt9aa; Lenovo Ideacentre 720-18Icb Firmware o3qkt32a; Lenovo Ideacentre 730S-24Ikb Firmware o3wkt15a; Lenovo Legion C530-19Icb Firmware o3lkt20a; Lenovo Legion C730-19Ico Firmware o3nkt20a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-6156 or the next vulnerability affects your stack