CVE-2017-3767 : A local privilege escalation vulnerability was identified in the Realtek audio d

A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products. An attacker with local privileges could execute code with administrative privileges.

Published 2017-11-13 16:29:00

Updated 2019-10-03 00:03:26

Source Lenovo Group Ltd.

View at NVD, CVE.org

Vulnerability category: Execute codeGain privilege

Products affected by CVE-2017-3767

Realtek » Audio Driver Firmware
Versions before (<) 6.0.1.8224
cpe:2.3:o:realtek:audio_driver_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad 10 » Version: N/A
When used together with: Lenovo » Thinkpad 11e » Version: N/A
When used together with: Lenovo » Thinkpad 13 » Version: N/A
When used together with: Lenovo » Thinkpad L450 » Version: N/A
When used together with: Lenovo » Thinkpad L460 » Version: N/A
When used together with: Lenovo » Thinkpad L470 Kbl » Version: N/A
When used together with: Lenovo » Thinkpad L470 Skl » Version: N/A
When used together with: Lenovo » Thinkpad L560 » Version: N/A
When used together with: Lenovo » Thinkpad P50 » Version: N/A
When used together with: Lenovo » Thinkpad P50s » Version: N/A
When used together with: Lenovo » Thinkpad P51s » Version: N/A
When used together with: Lenovo » Thinkpad P70 » Version: N/A
When used together with: Lenovo » Thinkpad P71 » Version: N/A
When used together with: Lenovo » Thinkpad S1 » Version: N/A
When used together with: Lenovo » Thinkpad S1 Yoga » Version: N/A
When used together with: Lenovo » Thinkpad S1 Yoga 12 » Version: N/A
When used together with: Lenovo » Thinkpad S2 » Version: N/A
When used together with: Lenovo » Thinkpad T440 » Version: N/A
When used together with: Lenovo » Thinkpad T440p » Version: N/A
When used together with: Lenovo » Thinkpad T440s » Version: N/A
When used together with: Lenovo » Thinkpad T450 » Version: N/A
When used together with: Lenovo » Thinkpad T450s » Version: N/A
When used together with: Lenovo » Thinkpad T460 » Version: N/A
When used together with: Lenovo » Thinkpad T460p » Version: N/A
When used together with: Lenovo » Thinkpad T460s » Version: N/A
When used together with: Lenovo » Thinkpad T470 » Version: N/A
When used together with: Lenovo » Thinkpad T470p » Version: N/A
When used together with: Lenovo » Thinkpad T470s Skl » Version: N/A
When used together with: Lenovo » Thinkpad T540p » Version: N/A
When used together with: Lenovo » Thinkpad T550 » Version: N/A
When used together with: Lenovo » Thinkpad T560 » Version: N/A
When used together with: Lenovo » Thinkpad T570 » Version: N/A
When used together with: Lenovo » Thinkpad W540 » Version: N/A
When used together with: Lenovo » Thinkpad W541 » Version: N/A
When used together with: Lenovo » Thinkpad W550s » Version: N/A
When used together with: Lenovo » Thinkpad X1 Carbon » Version: N/A
When used together with: Lenovo » Thinkpad X1 Tablet » Version: N/A
When used together with: Lenovo » Thinkpad X1 Yoga » Version: N/A
When used together with: Lenovo » Thinkpad X1c » Version: N/A
When used together with: Lenovo » Thinkpad X240 » Version: N/A
When used together with: Lenovo » Thinkpad X240s » Version: N/A
When used together with: Lenovo » Thinkpad X250 » Version: N/A
When used together with: Lenovo » Thinkpad X260 » Version: N/A
When used together with: Lenovo » Thinkpad X270 Kbl » Version: N/A
When used together with: Lenovo » Thinkpad X270 Skl » Version: N/A
When used together with: Lenovo » Thinkpad Yoga 11e » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-3767

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-3767

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2017-3767

https://support.lenovo.com/us/en/product_security/LEN-15759

Local Privilege Escalation in Realtek Audio Driver - US
Issue Tracking;Third Party Advisory

Jump to

Vulnerability Details : CVE-2017-3767

Products affected by CVE-2017-3767

Exploit prediction scoring system (EPSS) score for CVE-2017-3767

CVSS scores for CVE-2017-3767

References for CVE-2017-3767