CVE-2022-1892 | Severity.io

Description

A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

Related CPE's

100e_2nd_gen_firmware

Vulnerable

100w_gen_3_firmware

Vulnerable

13w_yoga_firmware

Vulnerable

14w_gen_2_firmware

Vulnerable

300e_2nd_gen_firmware

Vulnerable

300w_gen_3_firmware

Vulnerable

500w_gen_3_firmware

Vulnerable

730s-13iml_firmware

Vulnerable

flex_3-11ada05_firmware

Vulnerable

flex_5-14alc05_firmware

Vulnerable

flex_5-14are05_firmware

Vulnerable

flex_5-14iil05_firmware

Vulnerable

flex_5-14itl05_firmware

Vulnerable

flex_5-15alc05_firmware

Vulnerable

flex_5-15iil05_firmware

Vulnerable

flex_5-15itl05_firmware

Vulnerable

ideapad_1-11ada05_firmware

Vulnerable

ideapad_1-11ada05

ideapad_1-11igl05_firmware

Vulnerable

ideapad_1-11igl05

ideapad_1-14ada05_firmware

Vulnerable

ideapad_1-14ada05

ideapad_1-14igl05_firmware

Vulnerable

ideapad_1-14igl05

ideapad_3-15ada05_firmware

Vulnerable

ideapad_3-15ada05

ideapad_3-14ada05_firmware

Vulnerable

ideapad_3-14ada05

ideapad_3-14ada6_firmware

Vulnerable

ideapad_3-14ada6

ideapad_3-14alc6_firmware

Vulnerable

ideapad_3-14alc6

ideapad_3-15ada6_firmware

Vulnerable

ideapad_3-15ada6

ideapad_3-15alc6_firmware

Vulnerable

ideapad_3-15alc6

ideapad_3-17alc6_firmware

Vulnerable

ideapad_3-17alc6

ideapad_3-17ada05_firmware

Vulnerable

ideapad_3-17ada05

ideapad_3-17ada6_firmware

Vulnerable

ideapad_3-17ada6

ideapad_5_15aba7_firmware

Vulnerable

ideapad_5_15aba7

ideapad_flex_5_14alc7_firmware

Vulnerable

ideapad_flex_5_14alc7

ideapad_flex_5_16alc7_firmware

Vulnerable

ideapad_flex_5_16alc7

legion_s7-15imh5_firmware

Vulnerable

legion_s7-15imh5

legion_s7-15ach6_firmware

Vulnerable

legion_s7-15ach6

legion_s7-15arh5_firmware

Vulnerable

legion_s7-15arh5

s145-14api_firmware

Vulnerable

s145-14ast_firmware

Vulnerable

s145-15api_firmware

Vulnerable

s145-15ast_firmware

Vulnerable

s540-13api_firmware

Vulnerable

ideapad_s940-14iil_firmware

Vulnerable

ideapad_s940-14iil

o

lenovo

yoga_s940-14iil_firmware

2

h

lenovo

yoga_s940-14iil

2

ideapad_slim_1-14ast-05_firmware

Vulnerable

ideapad_slim_1-14ast-05

ideapad_slim_1-11ast-05_firmware

Vulnerable

ideapad_slim_1-11ast-05

thinkbook_13s_g3_acn_firmware

Vulnerable

thinkbook_13s_g3_acn

thinkbook_13s_g2_are_firmware

Vulnerable

thinkbook_13s_g2_are

thinkbook_13s_g2_itl_firmware

Vulnerable

thinkbook_13s_g2_itl

thinkbook_13s-iml_firmware

Vulnerable

thinkbook_13s-iml

thinkbook_14-iil_firmware

Vulnerable

thinkbook_14-iil

thinkbook_14-iml_firmware

Vulnerable

thinkbook_14-iml

thinkbook_14p_g2_ach_firmware

Vulnerable

thinkbook_14p_g2_ach

thinkbook_14s_g2_itl_firmware

Vulnerable

thinkbook_14s_g2_itl

thinkbook_14s-iml_firmware

Vulnerable

thinkbook_14s-iml

thinkbook_15-iil_firmware

Vulnerable

thinkbook_15-iil

thinkbook_15-iml_firmware

Vulnerable

thinkbook_15-iml

thinkbook_16p_g2_ach_firmware

Vulnerable

thinkbook_16p_g2_ach

v130-15ikb_firmware

Vulnerable

v14_g2-alc_firmware

Vulnerable

v14-ada_firmware

Vulnerable

v15_g2-alc_firmware

Vulnerable

v15-ada_firmware

Vulnerable

yoga_9-15imh5_firmware

Vulnerable

yoga_c640-13iml_firmware

Vulnerable

yoga_c640-13iml

yoga_c640-13iml_lte_firmware

Vulnerable

yoga_c640-13iml_lte

yoga_c940-15irh_firmware

Vulnerable

yoga_c940-15irh

yoga_s730-13iml_firmware

Vulnerable

yoga_s730-13iml

yoga_slim_7_pro-14ach5_firmware

Vulnerable

yoga_slim_7_pro-14ach5

yoga_slim_7_pro-14ach5_o_firmware

Vulnerable

yoga_slim_7_pro-14ach5_o

yoga_slim_7_pro-14arh5_firmware

Vulnerable

yoga_slim_7_pro-14arh5

ideapad_5-15alc05_firmware

Vulnerable

ideapad_5-15alc05

References

https://support.lenovo.com/us/en/product_security/LEN-91369

Vendor Advisory

Weaknesses

[email protected]

Primary

CWE-120

[email protected]

Secondary

CWE-122

CVSS impact metrics

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 · High

CVSS V3.1
CVSS V3.0
CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Analyzed

Published

2023-01-26T21:15:25.467

2 years ago

Last modified

2023-02-03T18:17:50.007

2 years ago