CVE-2022-1890

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

References

Link	Resource
https://support.lenovo.com/us/en/product_security/LEN-91369	Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-91369	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:lenovo:thinkbook_14-iml_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:thinkbook_14-iml:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:lenovo:thinkbook_14-iil_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:thinkbook_14-iil:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:lenovo:thinkbook_15-iil_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:thinkbook_15-iil:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:lenovo:thinkbook_15-iml_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:thinkbook_15-iml:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

cpe:2.3:o:lenovo:yoga_c640-13iml_lte_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:yoga_c640-13iml_lte:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:lenovo:yoga_c640-13iml_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:yoga_c640-13iml:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:41

Type	Values Removed	Values Added
Summary		(es) Un desbordamiento del búfer en el controlador ReadyBootDxe en algunos productos portátiles Lenovo puede permitir que un atacante con privilegios locales ejecute código arbitrario.
References	~~() https://support.lenovo.com/us/en/product_security/LEN-91369 - Vendor Advisory~~	() https://support.lenovo.com/us/en/product_security/LEN-91369 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 6.7

Information

Published : 2023-01-26 21:15

Updated : 2024-11-21 06:41

NVD link : CVE-2022-1890

Mitre link : CVE-2022-1890

CVE.ORG link : CVE-2022-1890

JSON object : View

Products Affected

CWE

CWE-122

Heap-based Buffer Overflow

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-1890", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-01-26T21:15:24.803", "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-91369", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://support.lenovo.com/us/en/product_security/LEN-91369", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-122"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code."}, {"lang": "es", "value": "Un desbordamiento del b\u00fafer en el controlador ReadyBootDxe en algunos productos port\u00e1tiles Lenovo puede permitir que un atacante con privilegios locales ejecute c\u00f3digo arbitrario."}], "lastModified": "2024-11-21T06:41:41.380", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:thinkbook_14-iml_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "495AE9CC-8F17-40CF-98AA-8CD8DAF49E29", "versionEndExcluding": "cjcn38ww"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:thinkbook_14-iml:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B6839816-92D3-4698-893E-DF7D99C487C1"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:thinkbook_14-iil_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "036C342E-1F74-4B63-A06B-06157A6797E8", "versionEndExcluding": "djcn28ww"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:thinkbook_14-iil:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E1CF3129-19E2-4649-B0E8-79EB5B3EB1F7"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:thinkbook_15-iil_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4947120-80EC-4DD8-B386-80FF9E749B76", "versionEndExcluding": "djcn28ww"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:thinkbook_15-iil:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F4CEE028-83AF-4AFD-A3F1-C0DA6070FC48"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:thinkbook_15-iml_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BF015D2-2202-4330-A1F2-9E319A0CFC73", "versionEndExcluding": "cjcn38ww"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:thinkbook_15-iml:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CA4C15FE-8601-4948-BCF4-5A4A5E307759"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:yoga_c640-13iml_lte_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3FA80A4-ED4B-40E1-AC05-F355A880C374", "versionEndExcluding": "chcn28ww"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:yoga_c640-13iml_lte:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6E2E3608-02DC-40C8-A92D-04E50B81F534"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:yoga_c640-13iml_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E747094D-17B6-4954-A346-46934230091B", "versionEndExcluding": "chcn28ww"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:yoga_c640-13iml:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "709C368C-A159-45F9-BD23-ED07A5CF08A2"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}