Part 4 of 4: the Lenovo WmiBiosSetupSmm disclosure. See Part 1 (the chain), Part 2 (validation), and Part 3 (authorization).
The first three parts covered the bugs. This one covers the process, because a firmware finding is only as good as the coordination that turns it into a fix. Here is the full LEN-213632 timeline, what Lenovo accepted and rejected, and the remediation that shipped.
Timeline
| Date | Event |
|---|---|
| 8 Mar 2026 | Reported to Lenovo PSIRT with a live PoC and full binary analysis of the SMM attack surface. |
| 11 Mar | Acknowledged; tracked as LEN-213632. Disclosure policy exchanged (90-day coordinated window). |
| 13 Mar | Initial assessment complete: four findings confirmed valid, one rejected, one routed to the component owner. |
| 17 Apr | Fixed BIOS packages expected end of June; advisory planned for Patch Tuesday, 14 July. |
| 2 Jun | CVEs reserved: CVE-2026-10587 through -10590. |
| Jun | Fixed BIOS packages released. |
| 14 Jul | Advisory LEN-220440 published; embargo lifted. |
What was accepted, and what wasn’t
The original report contained six findings (F06-A through F06-F). Triage is part of the job, and Lenovo’s was precise:
- F06-A / -B / -C / -F: confirmed valid in the BIOS code and assigned CVE-2026-10587, -10588, -10589 and -10590 respectively.
- F06-D, not a valid vulnerability. The
LfcWmiServiceSmmcode is present but not reachable on production units: once manufacturing completes, the module does not install its SMI callback or ACPI structure. A fair call, and a good reminder that a handler in the image isn’t the same as a handler on the attack surface. - F06-E: owned by Insyde. The
IhisiServicesSmmpre-auth buffer check belongs to a module Insyde develops, so they took the lead on that thread.
Four of six landing as CVEs, with the rejections clearly reasoned, is a healthy outcome, and the disagreement on F06-D was resolved on evidence, not opinion.
Remediation
The fixes map one-to-one onto the gaps:
- Call
SmmIsBufferOutsideSmmValid()on OS-influenced buffers before use (10587). - Validate the
BNVS/CommBufferSizebounds before parsing (10589). - Authenticate or restrict who can invoke the WMI BIOS-setup SMI path (10590).
- Stop writing a live SMRAM address into a runtime-readable EFI variable / DSDT field (10588).
If you run an affected Lenovo platform, update your BIOS. The fixes shipped ahead of the 14 July advisory.
Why coordinated disclosure was worth it here
Firmware fixes are slow by nature: long validation cycles, multiple vendors (Lenovo and Insyde here), and devices that live for years. A 90-day clock with real status updates gave the fix time to ship before any technical detail went public, which is the entire point: users were protected first, and the write-ups you’re reading now add nothing an attacker didn’t already have to work for. My thanks to the Lenovo PSIRT team for being responsive and precise throughout.
The full set
- CVE-2026-10587: no
SmmIsBufferOutsideSmmValidinWmiBiosSetupSmm - CVE-2026-10588: ACPI BNVS pointer leak → SMRAM address disclosure
- CVE-2026-10589: no
CommBufferSizevalidation on SMI0xDE - CVE-2026-10590: no authentication on WMI BIOS Setup SMI
0xDE - Lenovo advisory LEN-220440
Found something in your firmware or AI stack that shouldn’t be reachable? That’s what XSource does, get in touch.
