CVE-2021-3971

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-489

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-397109.8Product: AndroidVersions: Android kernelAndroid ID: A-202160245References: N/ACVE-2021-397114.4In bpf_prog_test_run_skb of test_run.c, there is a possible out of bounds read due to Incorrect Size Value. This could lead to local informaCVE-2021-397126.4In TBD of TBD, there is a possible user after free vulnerability due to a race condition. This could lead to local escalation of privilege wCVE-2021-397137.0Product: AndroidVersions: Android kernelAndroid ID: A-173788806References: Upstream kernelCVE-2021-397147.8In ion_buffer_kmap_get of ion.c, there is a possible use-after-free due to an integer overflow. This could lead to local escalation of priviCVE-2021-397154.4In __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log information disclosure. This could lead to lCVE-2021-397167.5Product: AndroidVersions: Android kernelAndroid ID: A-206977562References: N/ACVE-2021-397174.4In iaxxx_btp_write_words of iaxxx-btp.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local iCVE-2021-397186.7In ProtocolStkProactiveCommandAdapter::Init of protocolstkadapter.cpp, there is a possible out of bounds write due to an incorrect bounds chCVE-2021-397196.7In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an integer overflow. This could lead to local eCVE-2021-39726.7A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly nCVE-2021-397209.8Product: AndroidVersions: Android kernelAndroid ID: A-207433926References: N/A
CVE-2021-3971: Medium severity, CVSS 6.7 | Vulnix