CVE-2023-4029

Published: Aug 17, 2023Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected (26)

Lenovo

26 products

K14 Type 21cu Firmware

K14 Type 21cv Firmware

Thinkpad S2 Yoga Gen 8 Firmware

Thinkpad E14 Gen 3 Firmware

Thinkpad E15 Gen 3 Firmware

Thinkpad L13 Gen 2 Firmware

Thinkpad L13 Gen 3 Firmware

Thinkpad L13 Gen 4 Firmware

Thinkpad L13 Yoga Gen 4 Firmware

Thinkpad L13 Yoga Gen 2 Firmware

Thinkpad L13 Yoga Gen 3 Firmware

Thinkpad L14 Gen 2 Firmware

Thinkpad L14 Gen 3 Firmware

Thinkpad L14 Gen 4 Firmware

Thinkpad L15 Gen 2 Firmware

Thinkpad L15 Gen 3 Firmware

Thinkpad L15 Gen 4 Firmware

Thinkpad P14s Gen 2 Firmware

Thinkpad T14 Gen 2 Firmware

Thinkpad T14s Gen 2 Firmware

Thinkpad S2 Gen 6 Firmware

Thinkpad S2 Gen 7 Firmware

Thinkpad S2 Gen 8 Firmware

Thinkpad S2 Yoga Gen 6 Firmware

Thinkpad S2 Yoga Gen 7 Firmware

Thinkpad X13 Gen 2 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo K14 Type 21cu Firmware	Before 1.12

Running on/with	Platform Versions
Lenovo K14 Type 21cu	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo K14 Type 21cv Firmware	Before 1.12

Running on/with	Platform Versions
Lenovo K14 Type 21cv	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S2 Yoga Gen 8 Firmware	Before 1.10

Running on/with	Platform Versions
Lenovo Thinkpad S2 Yoga Gen 8	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad E14 Gen 3 Firmware	Before 1.15

Running on/with	Platform Versions
Lenovo Thinkpad E14 Gen 3	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad E15 Gen 3 Firmware	Before 1.15

Running on/with	Platform Versions
Lenovo Thinkpad E15 Gen 3	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Gen 2 Firmware	Before 1.30

Running on/with	Platform Versions
Lenovo Thinkpad L13 Gen 2	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Gen 3 Firmware	Before 1.19

Running on/with	Platform Versions
Lenovo Thinkpad L13 Gen 3	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Gen 4 Firmware	Before 1.10

Running on/with	Platform Versions
Lenovo Thinkpad L13 Gen 4	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Yoga Gen 4 Firmware	Before 1.10

Running on/with	Platform Versions
Lenovo Thinkpad L13 Yoga Gen 4	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Yoga Gen 2 Firmware	Before 1.30

Running on/with	Platform Versions
Lenovo Thinkpad L13 Yoga Gen 2	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L13 Yoga Gen 3 Firmware	Before 1.19

Running on/with	Platform Versions
Lenovo Thinkpad L13 Yoga Gen 3	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L14 Gen 2 Firmware	Before 1.28

Running on/with	Platform Versions
Lenovo Thinkpad L14 Gen 2	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L14 Gen 3 Firmware	Before 1.23

Running on/with	Platform Versions
Lenovo Thinkpad L14 Gen 3	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L14 Gen 4 Firmware	Before 1.06

Running on/with	Platform Versions
Lenovo Thinkpad L14 Gen 4	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L15 Gen 2 Firmware	Before 1.28

Running on/with	Platform Versions
Lenovo Thinkpad L15 Gen 2	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L15 Gen 3 Firmware	Before 1.23

Running on/with	Platform Versions
Lenovo Thinkpad L15 Gen 3	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad L15 Gen 4 Firmware	Before 1.06

Running on/with	Platform Versions
Lenovo Thinkpad L15 Gen 4	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad P14s Gen 2 Firmware	Before 1.34

Running on/with	Platform Versions
Lenovo Thinkpad P14s Gen 2	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad T14 Gen 2 Firmware	Before 1.34

Running on/with	Platform Versions
Lenovo Thinkpad T14 Gen 2	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad T14s Gen 2 Firmware	Before 1.37

Running on/with	Platform Versions
Lenovo Thinkpad T14s Gen 2	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S2 Gen 6 Firmware	Before 1.30

Running on/with	Platform Versions
Lenovo Thinkpad S2 Gen 6	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S2 Gen 7 Firmware	Before 1.19

Running on/with	Platform Versions
Lenovo Thinkpad S2 Gen 7	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S2 Gen 8 Firmware	Before 1.10

Running on/with	Platform Versions
Lenovo Thinkpad S2 Gen 8	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S2 Yoga Gen 6 Firmware	Before 1.30

Running on/with	Platform Versions
Lenovo Thinkpad S2 Yoga Gen 6	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad S2 Yoga Gen 7 Firmware	Before 1.19

Running on/with	Platform Versions
Lenovo Thinkpad S2 Yoga Gen 7	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lenovo Thinkpad X13 Gen 2 Firmware	Before 1.37

Running on/with	Platform Versions
Lenovo Thinkpad X13 Gen 2	All versions

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (2)

https://support.lenovo.com/us/en/product_security/LEN-134879

Source: psirt@lenovo.com

Vendor Advisory

https://support.lenovo.com/us/en/product_security/LEN-134879

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.