Lucene search

[email protected]CVE-2023-4029

HistoryAug 17, 2023 - 5:15 p.m.

CVE-2023-4029

2023-08-1717:15:10

CWE-120

[email protected]

web.nvd.nist.gov

cve-2023-4029

buffer overflow

lenovo

thinkpad

boardupdateacpidxe

security vulnerability

local access

elevated privileges

arbitrary code execution

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected configurations

NVD

Node

lenovok14_type_21cu_firmwareRange<1.12

AND

lenovok14_type_21cuMatch-

Node

lenovok14_type_21cv_firmwareRange<1.12

AND

lenovok14_type_21cvMatch-

Node

lenovothinkpad_s2_yoga_gen_8_firmwareRange<1.10

AND

lenovothinkpad_s2_yoga_gen_8Match-

Node

lenovothinkpad_e14_gen_3_firmwareRange<1.15

AND

lenovothinkpad_e14_gen_3Match-

Node

lenovothinkpad_e15_gen_3_firmwareRange<1.15

AND

lenovothinkpad_e15_gen_3Match-

Node

lenovothinkpad_l13_gen_2_firmwareRange<1.30

AND

lenovothinkpad_l13_gen_2Match-

Node

lenovothinkpad_l13_gen_3_firmwareRange<1.19

AND

lenovothinkpad_l13_gen_3Match-

Node

lenovothinkpad_l13_gen_4_firmwareRange<1.10

AND

lenovothinkpad_l13_gen_4Match-

Node

lenovothinkpad_l13_yoga_gen_4_firmwareRange<1.10

AND

lenovothinkpad_l13_yoga_gen_4Match-

Node

lenovothinkpad_l13_yoga_gen_2_firmwareRange<1.30

AND

lenovothinkpad_l13_yoga_gen_2Match-

Node

lenovothinkpad_l13_yoga_gen_3_firmwareRange<1.19

AND

lenovothinkpad_l13_yoga_gen_3Match-

Node

lenovothinkpad_l14_gen_2_firmwareRange<1.28

AND

lenovothinkpad_l14_gen_2Match-

Node

lenovothinkpad_l14_gen_3_firmwareRange<1.23

AND

lenovothinkpad_l14_gen_3Match-

Node

lenovothinkpad_l14_gen_4_firmwareRange<1.06

AND

lenovothinkpad_l14_gen_4Match-

Node

lenovothinkpad_l15_gen_2_firmwareRange<1.28

AND

lenovothinkpad_l15_gen_2Match-

Node

lenovothinkpad_l15_gen_3_firmwareRange<1.23

AND

lenovothinkpad_l15_gen_3Match-

Node

lenovothinkpad_l15_gen_4_firmwareRange<1.06

AND

lenovothinkpad_l15_gen_4Match-

Node

lenovothinkpad_p14s_gen_2_firmwareRange<1.34

AND

lenovothinkpad_p14s_gen_2Match-

Node

lenovothinkpad_t14_gen_2_firmwareRange<1.34

AND

lenovothinkpad_t14_gen_2Match-

Node

lenovothinkpad_t14s_gen_2_firmwareRange<1.37

AND

lenovothinkpad_t14s_gen_2Match-

Node

lenovothinkpad_s2_gen_6_firmwareRange<1.30

AND

lenovothinkpad_s2_gen_6Match-

Node

lenovothinkpad_s2_gen_7_firmwareRange<1.19

AND

lenovothinkpad_s2_gen_7Match-

Node

lenovothinkpad_s2_gen_8_firmwareRange<1.10

AND

lenovothinkpad_s2_gen_8Match-

Node

lenovothinkpad_s2_yoga_gen_6_firmwareRange<1.30

AND

lenovothinkpad_s2_yoga_gen_6Match-

Node

lenovothinkpad_s2_yoga_gen_7_firmwareRange<1.19

AND

lenovothinkpad_s2_yoga_gen_7Match-

Node

lenovothinkpad_x13_gen_2_firmwareRange<1.37

AND

lenovothinkpad_x13_gen_2Match-

CPENameOperatorVersion
lenovo:k14_type_21cu_firmwarelenovo k14 type 21cu firmwarelt1.12

CPE	Name	Operator	Version
lenovo:k14_type_21cu_firmware	lenovo k14 type 21cu firmware	lt	1.12

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ThinkPad",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-134879

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2023-4029

nvd1 prion1 cvelist1