Medium severity · published Aug 17, 2023
CVE-2023-4029
A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to…
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TH
ThinkPad · Lenovo
various · source: vendor, CISA
KT
K14 Type 21cu Firmware · Lenovo
before 1.12 · source: NVD
KT
K14 Type 21cv Firmware · Lenovo
before 1.12 · source: NVD
TE
Thinkpad E14 Gen 3 Firmware · Lenovo
before 1.15 · source: NVD
TE
Thinkpad E15 Gen 3 Firmware · Lenovo
before 1.15 · source: NVD
TL
Thinkpad L13 Gen 2 Firmware · Lenovo
before 1.30 · source: NVD
TL
Thinkpad L13 Gen 3 Firmware · Lenovo
before 1.19 · source: NVD
TL
Thinkpad L13 Gen 4 Firmware · Lenovo
before 1.10 · source: NVD
TL
Thinkpad L13 Yoga Gen 2 Firmware · Lenovo
before 1.30 · source: NVD
TL
Thinkpad L13 Yoga Gen 3 Firmware · Lenovo
before 1.19 · source: NVD
TL
Thinkpad L13 Yoga Gen 4 Firmware · Lenovo
before 1.10 · source: NVD
TL
Thinkpad L14 Gen 2 Firmware · Lenovo
before 1.28 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-4029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-4029
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-134879
More from ThinkPad
7.8
CVE-2023-4030
A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes…
6.7
CVE-2023-5078
A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware
6.7
CVE-2022-48189
An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code
6.7
CVE-2022-4574
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code
6.7
CVE-2023-2290
A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary code