CVE-2023-45077

CVE-2023-45077 describes a memory-leak vulnerability in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. Documents consistently identify the affected component as the 534D0740 DXE driver and indicate local attack vector with high impact...

CVE-2023-45077

A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables...

CVE-2023-45076

A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables...

CVE-2023-45076

A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables...

CVE-2023-45076

The CVE-2023-45076 issue is a memory leakage vulnerability in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. Affected component: 534D0140 DXE driver. Impact per sources: potential compromise of confidentiality, integrity, and availabi...

CVE-2023-45075

CVE-2023-45075 describes a memory-leakage vulnerability in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. The issue is documented across multiple sources (NVD/Red Hat/NV mentions) and is associated with a CVSSv3.1 score of 6.7 (Me...

CVE-2023-45075

A memory leakage vulnerability was reported in the SWSMIShadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables...

CVE-2023-45075

A memory leakage vulnerability was reported in the SWSMIShadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables...

PT-2023-29395 · Unknown · 534D0140 Dxe Driver

Name of the Vulnerable Software and Affected Versions: 534D0140 DXE driver affected versions not specified Description: A memory leakage issue was reported in the 534D0140 DXE driver, potentially allowing a local attacker with elevated privileges to write to NVRAM variables. Recommendations: At t...

PT-2023-29398 · Unknown · Nvmramsmm Smm Driver

Name of the Vulnerable Software and Affected Versions: Insufficient information is provided to determine the specific affected software versions. Description: A memory leakage issue was reported in the NvmramSmm SMM driver, potentially allowing a local attacker with elevated privileges to write t...

PT-2023-29394 · Unknown · Swsmi Shadow Dxe Driver

Name of the Vulnerable Software and Affected Versions: SWSMI Shadow DXE driver affected versions not specified Description: A memory leakage issue was reported in the SWSMI Shadow DXE driver, potentially allowing a local attacker with elevated privileges to write to NVRAM variables...

PT-2023-26866 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: An issue was discovered in IhisiServicesSmm where there are arbitrary calls to SetVariable with unsanitized arguments in the SMI handler. This allows for the modification of protected NVR...

PT-2023-26865 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O versions 5.0 through 5.5 Description: A memory corruption vulnerability in the SMM driver SMRAM write in CsmInt10HookSmm allows attackers to send arbitrary data to SMM, which could lead to privilege escalation. The...

CVE-2023-34365

A stack-based buffer overflow vulnerability exists in the libutils.so nvramrestore functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to a buffer overflow. An attacker can send a network request to trigger this vulnerability...

CVE-2023-24479

An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.020221108. A specially crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability...

PT-2023-6406 · Yifan · Yifan Yf325

Name of the Vulnerable Software and Affected Versions: Yifan YF325 version 1.0 20221108 Description: A stack-based buffer overflow vulnerability exists in the libutils.so nvram restore functionality. This issue can be triggered by a specially crafted network request, leading to a buffer overflow...

CVE-2022-3431

A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

Design/Logic Flaw

A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

CVE-2022-3431

A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable...

CVE-2022-3431

CVE-2022-3431 concerns a Lenovo Notebook driver used in manufacturing that was unintentionally included in production. A local attacker with elevated privileges could modify an NVRAM variable to change Secure Boot settings. Lenovo’s advisory LEN-94952 describes firmware updates as the mitigation ...