CVE-2023-34419

Published: Aug 17, 2023Modified: Nov 21, 2024

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected (30)

Lenovo

30 products

Legion 5 Pro 16iah7h Firmware

Legion 5 Pro 16iah7 Firmware

Legion 5 Pro 16arh7 Firmware

Legion 5 Pro 16arh7h Firmware

Legion 5 15arh7 Firmware

Legion 5 15arh7h Firmware

Legion 5 15iah7h Firmware

Legion 5 15iah7 Firmware

Legion 5 Pro 16ach6 Firmware

Legion 5 Pro 16ach6h Firmware

Legion 5 Pro 16ith6 Firmware

Legion 5 Pro 16ith6h Firmware

Legion 5 15ach6 Firmware

Legion 5 15ach6a Firmware

Legion 5 15ach6h Firmware

Legion 5 15ith6 Firmware

Legion 5 15ith6h Firmware

Legion 5 17ach6 Firmware

Legion 5 17ach6h Firmware

Legion 5 17ith6 Firmware

Legion 5 17ith6h Firmware

Legion 7 16arha7 Firmware

Legion 7 16achg6 Firmware

Legion 7 16ithg6 Firmware

Legion Pro 5 16irx8 Firmware

Legion Pro 7 16irx8 Firmware

Legion Pro 7 16irx8h Firmware

Legion S7 16arha7 Firmware

Thinkbook 16p G3 Arh Firmware

Thinkbook 15p G2 Ith Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 Pro 16iah7h Firmware	Before j2cn51ww

Running on/with	Platform Versions
Lenovo Legion 5 Pro 16iah7h	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 Pro 16iah7 Firmware	Before j2cn51ww

Running on/with	Platform Versions
Lenovo Legion 5 Pro 16iah7	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 Pro 16arh7 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 Pro 16arh7	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 Pro 16arh7h Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 Pro 16arh7h	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15arh7 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 15arh7	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15arh7h Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 15arh7h	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15iah7h Firmware	Before j2cn51ww

Running on/with	Platform Versions
Lenovo Legion 5 15iah7h	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15iah7 Firmware	Before j2cn51ww

Running on/with	Platform Versions
Lenovo Legion 5 15iah7	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 Pro 16ach6 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 Pro 16ach6	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 Pro 16ach6h Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 Pro 16ach6h	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 Pro 16ith6 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 Pro 16ith6	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 Pro 16ith6h Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 Pro 16ith6h	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15ach6 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 15ach6	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15ach6a Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 15ach6a	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15ach6h Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 15ach6h	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15ith6 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 15ith6	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 15ith6h Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 15ith6h	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 17ach6 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 17ach6	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 17ach6h Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 17ach6h	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 17ith6 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 17ith6	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 5 17ith6h Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 5 17ith6h	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 7 16arha7 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 7 16arha7	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 7 16achg6 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 7 16achg6	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion 7 16ithg6 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion 7 16ithg6	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion Pro 5 16irx8 Firmware	Before kwcn37ww

Running on/with	Platform Versions
Lenovo Legion Pro 5 16irx8	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion Pro 7 16irx8 Firmware	Before kwcn37ww

Running on/with	Platform Versions
Lenovo Legion Pro 7 16irx8	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion Pro 7 16irx8h Firmware	Before kwcn37ww

Running on/with	Platform Versions
Lenovo Legion Pro 7 16irx8h	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Legion S7 16arha7 Firmware	All versions

Running on/with	Platform Versions
Lenovo Legion S7 16arha7	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkbook 16p G3 Arh Firmware	All versions

Running on/with	Platform Versions
Lenovo Thinkbook 16p G3 Arh	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkbook 15p G2 Ith Firmware	All versions

Running on/with	Platform Versions
Lenovo Thinkbook 15p G2 Ith	All versions

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (2)

https://support.lenovo.com/us/en/product_security/LEN-134879

Source: psirt@lenovo.com

Vendor Advisory

https://support.lenovo.com/us/en/product_security/LEN-134879

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.