Lenovo ThinkSystem UEFI/BIOS (SMM callout): A System Management Mode callout vulnerability in ThinkSystem UEFI

Impact

A System Management Mode callout vulnerability in ThinkSystem UEFI - SMM code calls out to memory it does not control, letting a local attacker with elevated privileges execute code in SMM. SMM sits above the hypervisor and is invisible to it, so this is a persistent-implant primitive: what an attacker installs there is not removed by reimaging, disk replacement or hypervisor reinstall. The affected list runs to roughly 99 platforms and explicitly includes the GPU boxes - SR670 V2 and SR675 V3 - alongside SR630/SR650/SR645/SR665 V3 and the ThinkAgile appliances.

Who can reach it

Local to the host with elevated privileges - root or administrator on the operating system. Not reachable from the management VLAN; the path is a tenant or workload that already holds privileged host access.

What to do

UEFI/BIOS update on each affected node, per the per-model version table in LEN-165524. This is the expensive kind: the payload can be staged through XCC, but it applies only on the next host reboot, so it needs a drain of running training jobs and a maintenance window per node. For SR670 V2 / SR675 V3 GPU nodes that is real lost capacity - plan it as a rolling campaign against spare capacity, not an emergency sweep. No config-only mitigation exists for an SMM defect.

References