VulnerabilityModified
CVE-2023-4029
A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
MEDIUM 6.7EPSS 0.19%
Does this matter?
Lower severity and a low EPSS score (0.19%). Track it; it rarely justifies an emergency change on its own.
Description
A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- CVSS 3.1
- 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.19% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-120
- Affected
- lenovo/k14 type 21cu firmware · lenovo/k14 type 21cv firmware · lenovo/thinkpad s2 yoga gen 8 firmware · lenovo/thinkpad e14 gen 3 firmware · lenovo/thinkpad e15 gen 3 firmware · lenovo/thinkpad l13 gen 2 firmware · lenovo/thinkpad l13 gen 3 firmware · lenovo/thinkpad l13 gen 4 firmware · lenovo/thinkpad l13 yoga gen 4 firmware · lenovo/thinkpad l13 yoga gen 2 firmware · lenovo/thinkpad l13 yoga gen 3 firmware · lenovo/thinkpad l14 gen 2 firmware · lenovo/thinkpad l14 gen 3 firmware · lenovo/thinkpad l14 gen 4 firmware · lenovo/thinkpad l15 gen 2 firmware · lenovo/thinkpad l15 gen 3 firmware · lenovo/thinkpad l15 gen 4 firmware · lenovo/thinkpad p14s gen 2 firmware · lenovo/thinkpad t14 gen 2 firmware · lenovo/thinkpad t14s gen 2 firmware · +6 more
- Source
- psirt@lenovo.com
References
- https://support.lenovo.com/us/en/product_security/LEN-134879Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-134879Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.