CVE-2024-26836 platform/x86: think-lmi: Fix password opcode ordering for workstations

2024-04-1710:10:03

Linux

www.cve.org

linux kernel

platform/x86

think-lmi

vulnerability

password opcode

workstations

lenovo

thinkpads

attribute value

admin password

AI Score

6.9

Confidence

Low

EPSS

Percentile

9.0%

JSON

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: think-lmi: Fix password opcode ordering for workstations

The Lenovo workstations require the password opcode to be run before
the attribute value is changed (if Admin password is enabled).

Tested on some Thinkpads to confirm they are OK with this order too.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/platform/x86/think-lmi.c"
    ],
    "versions": [
      {
        "version": "640a5fa50a42",
        "lessThan": "2bfbe1e0aed0",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "640a5fa50a42",
        "lessThan": "6f7d0f5fd8e4",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "drivers/platform/x86/think-lmi.c"
    ],
    "versions": [
      {
        "version": "5.17",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "5.17",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.7.7",
        "lessThanOrEqual": "6.7.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]