Multiple SMM memory corruption vulnerabilities in SMM module on Lenovo device (SMRAM write).

EFI_STATUS SwSmiHandler(
        EFI_HANDLE DispatchHandle,
        const void *Context,
        EFI_SMM_SW_CONTEXT *CommBuffer,
        UINTN *CommBufferSize)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS NUMPAD "+" TO EXPAND]

  CpuIndex = CommBuffer->SwSmiCpuIndex;
  if ( (gEfiSmmCpuProtocol->ReadSaveState(
          gEfiSmmCpuProtocol,
          4,
          EFI_SMM_SAVE_STATE_REGISTER_RSI,
          CommBuffer->SwSmiCpuIndex,
          &RsiReg)
      & 0x8000000000000000) != 0 )
    return EFI_ACCESS_DENIED;

  // Param is an attacker contolled pointer
  Param = (UINT16 *)RsiReg;

  if ( (gEfiSmmCpuProtocol->ReadSaveState(
          gEfiSmmCpuProtocol,
          2,
          EFI_SMM_SAVE_STATE_REGISTER_RFLAGS,
          CpuIndex,
          &RflagsReg)
      & 0x8000000000000000) != 0 )
    return EFI_ACCESS_DENIED;

  Command = *Param;
  if ( Command <= 0x5380 )
  {
    if ( Command != 0x5380 )
    {
      ...
    }
  }
  ...
  if ( Status >= 0 )
  {
    Param[12] &= ~1;                            // SMRAM write
    *(Param + 1) = 0;                           // SMRAM write
  }
  else
  {
    Param[12] |= 1;                             // SMRAM write
  }
_CheckStatus:
  if ( Status < 0 )
  {
    Param[12] |= 1;                             // SMRAM write
    goto _WriteRflags;
  }
_WriteRflagsAndParam:
  Param[12] &= ~1;                              // SMRAM write
_WriteRflags:
  RflagsReg &= 0xFFFA;
  gEfiSmmCpuProtocol->WriteSaveState(gEfiSmmCpuProtocol, 2, EFI_SMM_SAVE_STATE_REGISTER_RFLAGS, CpuIndex, &RflagsReg);
  return 0;
}

if ( Status >= 0 )
{
  Param[12] &= ~1;                            // SMRAM write
  *(Param + 1) = 0;                           // SMRAM write
}
else
{
  Param[12] |= 1;                             // SMRAM write
}
_CheckStatus:
if ( Status < 0 )
{
  Param[12] |= 1;                             // SMRAM write
  goto _WriteRflags;
}
_WriteRflagsAndParam:
Param[12] &= ~1;                              // SMRAM write
_WriteRflags:
RflagsReg &= 0xFFFA;
gEfiSmmCpuProtocol->WriteSaveState(gEfiSmmCpuProtocol, 2, EFI_SMM_SAVE_STATE_REGISTER_RFLAGS, CpuIndex, &RflagsReg);

MACRO_EFI sub_1AF0(UINT16 *Param)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS NUMPAD "+" TO EXPAND]

...
_Exit:
  // SMRAM write
  *Param = *Param;
  *Param |= Value << 8;
  return Status;
}

if ( Param[2] == 0x7004 )
{
  Status = gSmst->SmmLocateProtocol(&FDISK_OEM_SMM_PROTOCOL_GUID, 0, &gFdiskOemSmmProtocol);
  if ( Status >= 0 )
  {
    gFdiskOemSmmProtocol->Func38();
    gRT->ResetSystem(EfiResetShutdown, 0, 0, 0); // SMM callout
  }
}
else
{
  Status = EFI_INVALID_PARAMETER;
  *Param = 2688;                            // SMRAM write
}

...
MEMORY[4] = 0xFFFEFFFE;
SetMem(gBuffer, 0x30, Value);
Status = gBS->LocateHandleBuffer(ByProtocol, &EFI_USB_IO_PROTOCOL_GUID, 0, &NoHandles, &Buffer);
if ( Status >= 0 && NoHandles )
{
  Index = 0;
  Ptr = (ControlledBuffer + 16);
  while ( 1 )
  {
    Status = gBS->HandleProtocol(Buffer[v4], &EFI_USB_IO_PROTOCOL_GUID, &EfiUsbIoProtocol);
    if ( Status < 0 )
      break;
    EfiUsbIoProtocol0 = EfiUsbIoProtocol;
    if ( (EfiUsbIoProtocol->UsbGetDeviceDescriptor)(EfiUsbIoProtocol, &Descriptor) >= 0 && Descriptor.DeviceClass != 9 )
    {
      IdVendor = *(ControlledBuffer + 10);
      if ( Descriptor.IdVendor == IdVendor || !IdVendor || IdVendor == 255 )
      {
        IdProduct = *(ControlledBuffer + 12);
        if ( (Descriptor.IdProduct == IdProduct || !IdProduct || IdProduct == 255)
          && (EfiUsbIoProtocol0->UsbGetInterfaceDescriptor)(EfiUsbIoProtocol0, &InterfaceDescriptor) >= 0 )
        {
          InterfaceClass = *(ControlledBuffer + 8);
          if ( InterfaceDescriptor.InterfaceClass == InterfaceClass || ((InterfaceClass + 1) & 0xFE) == 0 )
          ...
        }
      }
    }
  }
}