Lucene search

[email protected]CVE-2020-8337

HistoryJun 09, 2020 - 8:15 p.m.

CVE-2020-8337

2020-06-0920:15:22

CWE-428

[email protected]

web.nvd.nist.gov

cve-2020-8337

synaptics smart audio

uwp

dchu audio drivers

lenovo platforms

vulnerability

administrative user

arbitrary code

nvd

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

An unquoted search path vulnerability was reported in versions prior to 1.0.83.0 of the Synaptics Smart Audio UWP app associated with the DCHU audio drivers on Lenovo platforms that could allow an administrative user to execute arbitrary code.

Affected configurations

NVD

Node

lenovo5-15ikbMatch-

lenovoair-14_2019Match-

lenovoc340-14iwlMatch-

lenovoflex-14iwlMatch-

lenovos540-14iwlMatch-

lenovos540-14iwl_touchMatch-

lenovothinkpad_11eMatch-

lenovothinkpad_13Match-

lenovothinkpad_a275Match-

lenovothinkpad_a285Match-

lenovothinkpad_a475Match-

lenovothinkpad_a485Match-

lenovothinkpad_e450Match-

lenovothinkpad_e450cMatch-

lenovothinkpad_e455Match-

lenovothinkpad_e460Match-

lenovothinkpad_e465Match-

lenovothinkpad_e470Match-

lenovothinkpad_e475Match-

lenovothinkpad_e480Match-

lenovothinkpad_e485Match-

lenovothinkpad_e490Match-

lenovothinkpad_e490sMatch-

lenovothinkpad_e540Match-

lenovothinkpad_e545Match-

lenovothinkpad_e550Match-

lenovothinkpad_e550cMatch-

lenovothinkpad_e555Match-

lenovothinkpad_e560Match-

lenovothinkpad_e565Match-

lenovothinkpad_e570Match-

lenovothinkpad_e575Match-

lenovothinkpad_e580Match-

lenovothinkpad_e585Match-

lenovothinkpad_e590Match-

lenovothinkpad_edge_e440Match-

lenovothinkpad_edge_e445Match-

lenovothinkpad_l380Match-

lenovothinkpad_l380_yogaMatch-

lenovothinkpad_l390_yogaMatch-

lenovothinkpad_l440Match-

lenovothinkpad_l450Match-

lenovothinkpad_l460Match-

lenovothinkpad_l470Match-

lenovothinkpad_l480Match-

lenovothinkpad_l540Match-

lenovothinkpad_l580Match-

lenovothinkpad_p1Match-

lenovothinkpad_p40Match-

lenovothinkpad_p53Match-

lenovothinkpad_p73Match-

lenovothinkpad_r490Match-

lenovothinkpad_r590Match-

lenovothinkpad_s1_3rdMatch-

lenovothinkpad_s1_yoga_12Match-

lenovothinkpad_s2_yoga_3rd_genMatch-

lenovothinkpad_s2_yoga_4th_genMatch-

lenovothinkpad_s3Match-

lenovothinkpad_s3-s440Match-

lenovothinkpad_s3_3rd_genMatch-

lenovothinkpad_s3_yoga_14Match-

lenovothinkpad_s5Match-

lenovothinkpad_t450Match-

lenovothinkpad_t450sMatch-

lenovothinkpad_t460Match-

lenovothinkpad_t460pMatch-

lenovothinkpad_t470pMatch-

lenovothinkpad_x1_extremeMatch-

lenovothinkpad_x260Match-

lenovothinkpad_x270Match-

lenovothinkpad_x380_yogaMatch-

lenovothinkpad_yoga_11eMatch-

lenovothinkpad_yoga_11e_3rd_genMatch-

lenovothinkpad_yoga_11e_4th_genMatch-

lenovothinkpad_yoga_11e_5th_genMatch-

lenovothinkpad_yoga_14_460_s3Match-

lenovothinkpad_yoga_370Match-

lenovov130-15igmMatch-

lenovov130-15ikbMatch-

lenovov310-15igmMatch-

lenovov330-15igmMatch-

lenovoyoga_14Match-

AND

synapticssmart_audio_uwpRange<1.0.83.0

CPENameOperatorVersion
synaptics:smart_audio_uwpsynaptics smart audio uwplt1.0.83.0

CPE	Name	Operator	Version
synaptics:smart_audio_uwp	synaptics smart audio uwp	lt	1.0.83.0

CNA Affected

[
  {
    "product": "Synaptics Smart Audio UWP App",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "1.0.83.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/len-30707

www.synaptics.com/sites/default/files/audio-driver-security-brief-2020-06-09.pdf

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.7%

JSON

Related for CVE-2020-8337

prion1 nvd1 lenovo2 cvelist1