VulnerabilityModified
CVE-2023-45075
A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
MEDIUM 6.7EPSS 0.22%
Does this matter?
Lower severity and a low EPSS score (0.22%). Track it; it rarely justifies an emergency change on its own.
Description
A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
- CVSS 3.1
- 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.22% probability · 12th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-125
- Affected
- lenovo/ideacentre c5-14imb05 firmware · lenovo/ideacentre 3-07ada05 firmware · lenovo/ideacentre 3-07imb05 firmware · lenovo/ideacentre g5-14imb05 firmware · lenovo/ideacentre 5-14iob6 firmware · lenovo/ideacentre creator 5-14iob6 firmware · lenovo/ideacentre g5-14amr05 firmware · lenovo/ideacentre gaming 5-14iob6 firmware · lenovo/ideacentre mini 5 01iaq7 firmware · lenovo/ideacentre mini 5-01imh05 firmware · lenovo/legion t7-34imz5 firmware · lenovo/thinkcentre m625q firmware · lenovo/thinkcentre m630e firmware · lenovo/thinkcentre m70a firmware · lenovo/thinkcentre m920z all-in-one firmware · lenovo/thinkcentre m920x firmware · lenovo/thinkcentre m920t firmware · lenovo/thinkcentre m920s firmware · lenovo/thinkcentre m920q firmware · lenovo/thinkcentre m90t firmware · +40 more
- Source
- psirt@lenovo.com
References
- https://support.lenovo.com/us/en/product_security/LEN-141775Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-141775Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.