CVE-2018-16098 : In some Lenovo ThinkPads, an unquoted search path vulnerability was found in var

In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.

Published 2019-01-24 22:29:00

Updated 2019-05-08 22:11:30

Source Lenovo Group Ltd.

View at NVD, CVE.org

Products affected by CVE-2018-16098

Lenovo » Synaptics Thinkpad Ultranav Driver » Version: 18.0.7.119
cpe:2.3:a:lenovo:synaptics_thinkpad_ultranav_driver:18.0.7.119:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 8.1 » Version: N/A Pro N Edition
Lenovo » Synaptics Thinkpad Ultranav Driver » Version: 19.5.19.33
cpe:2.3:a:lenovo:synaptics_thinkpad_ultranav_driver:19.5.19.33:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: N/A
Lenovo » Synaptics Thinkpad Ultranav Driver » Version: 19.0.17.140
cpe:2.3:a:lenovo:synaptics_thinkpad_ultranav_driver:19.0.17.140:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 8.1 » Version: N/A
Lenovo » Synaptics Thinkpad Ultranav Driver » Version: 19.3.4.219
cpe:2.3:a:lenovo:synaptics_thinkpad_ultranav_driver:19.3.4.219:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: N/A
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 8.1 » Version: N/A
Lenovo » Synaptics Thinkpad Ultranav Driver » Version: 16.2.19.23
cpe:2.3:a:lenovo:synaptics_thinkpad_ultranav_driver:16.2.19.23:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 8.1 » Version: N/A
Lenovo » Synaptics Thinkpad Ultranav Driver » Version: 18.1.27.42
cpe:2.3:a:lenovo:synaptics_thinkpad_ultranav_driver:18.1.27.42:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows 8.1 » Version: N/A
Lenovo » Thinkpad Helix Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_helix_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad Helix » Version: N/A
Lenovo » Thiankpad L430 Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_l430_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad L430 » Version: N/A
Lenovo » Thiankpad L530 Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_l530_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad L530 » Version: N/A
Lenovo » Thiankpad P1 Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_p1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad P1 » Version: N/A
Lenovo » Thiankpad X1 Extreme Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_x1_extreme_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad X1 Extreme » Version: N/A
Lenovo » Thiankpad P50s Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_p50s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad P50s » Version: N/A
Lenovo » Thiankpad P51 Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_p51_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad P51 » Version: N/A
Lenovo » Thiankpad P51s Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_p51s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad P51s » Version: N/A
Lenovo » Thiankpad P52s Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_p52s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad P52s » Version: N/A
Lenovo » Thiankpad P70 Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_p70_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad P70 » Version: N/A
Lenovo » Thiankpad S1 Yoga Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_s1_yoga_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad S1 Yoga » Version: N/A
Lenovo » Thiankpad S430 Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_s430_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad S430 » Version: N/A
Lenovo » Thiankpad T420 Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_t420_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad T420 » Version: N/A
Lenovo » Thiankpad T420i Firmware » Version: N/A
cpe:2.3:o:lenovo:thiankpad_t420i_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thiankpad T420i » Version: N/A
Lenovo » Thinkpad T420s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t420s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T420s » Version: N/A
Lenovo » Thinkpad T420si Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t420si_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T420si » Version: N/A
Lenovo » Thinkpad T430s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t430s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T430s » Version: N/A
Lenovo » Thinkpad T430i Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t430i_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T430i » Version: N/A
Lenovo » Thinkpad T431s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t431s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T431s » Version: N/A
Lenovo » Thinkpad T440 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t440_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T440 » Version: N/A
Lenovo » Thinkpad T440s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t440s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T440s » Version: N/A
Lenovo » Thinkpad T440p Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t440p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T440p » Version: N/A
Lenovo » Thinkpad T460s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t460s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T460s » Version: N/A
Lenovo » Thinkpad T470 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t470_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T470 » Version: N/A
Lenovo » Thinkpad T470s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t470s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T470s » Version: N/A
Lenovo » Thinkpad T520 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t520_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T520 » Version: N/A
Lenovo » Thinkpad T520i Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t520i_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T520i » Version: N/A
Lenovo » Thinkpad T530 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t530_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T530 » Version: N/A
Lenovo » Thinkpad T530i Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t530i_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T530i » Version: N/A
Lenovo » Thinkpad T540 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t540_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T540 » Version: N/A
Lenovo » Thinkpad T540p Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t540p_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T540p » Version: N/A
Lenovo » Thinkpad T550 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t550_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T550 » Version: N/A
Lenovo » Thinkpad T560 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t560_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T560 » Version: N/A
Lenovo » Thinkpad T570 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t570_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T570 » Version: N/A
Lenovo » Thinkpad T580 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_t580_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad T580 » Version: N/A
Lenovo » Thinkpad Twist Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_twist_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad Twist » Version: N/A
Lenovo » Thinkpad S230u Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_s230u_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad S230u » Version: N/A
Lenovo » Thinkpad W530 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_w530_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad W530 » Version: N/A
Lenovo » Thinkpad W540 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_w540_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad W540 » Version: N/A
Lenovo » Thinkpad W541 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_w541_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad W541 » Version: N/A
Lenovo » Thinkpad W550s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_w550s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad W550s » Version: N/A
Lenovo » Thinkpad X1 Carbon Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x1_carbon_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Carbon » Version: N/A
Lenovo » Thinkpad X1 Yoga Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x1_yoga_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Yoga » Version: N/A
Lenovo » Thinkpad X1 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x1_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 » Version: N/A
Lenovo » Thinkpad X1 Hybrid Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x1_hybrid_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X1 Hybrid » Version: N/A
Lenovo » Thinkpad X220 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x220_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X220 » Version: N/A
Lenovo » Thinkpad X220i Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x220i_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X220i » Version: N/A
Lenovo » Thinkpad X220 Tablet Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x220_tablet_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X220 Tablet » Version: N/A
Lenovo » Thinkpad X230 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x230_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X230 » Version: N/A
Lenovo » Thinkpad X230i Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x230i_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X230i » Version: N/A
Lenovo » Thinkpad X230 Tablet Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x230_tablet_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X230 Tablet » Version: N/A
Lenovo » Thinkpad X230i Tablet Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x230i_tablet_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X230i Tablet » Version: N/A
Lenovo » Thinkpad X230s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x230s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X230s » Version: N/A
Lenovo » Thinkpad X240s Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x240s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X240s » Version: N/A
Lenovo » Thinkpad X240 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x240_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X240 » Version: N/A
Lenovo » Thinkpad X250 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x250_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X250 » Version: N/A
Lenovo » Thinkpad X280 Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_x280_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad X280 » Version: N/A
Lenovo » Thinkpad Yoga 11e Firmware » Version: N/A
cpe:2.3:o:lenovo:thinkpad_yoga_11e_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkpad Yoga 11e » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-16098

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 10 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-16098

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-16098

CWE-428 Unquoted Search Path or Element

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-16098

https://support.lenovo.com/bg/en/product_security/len-24573

Synaptics Pointing Device Driver Vulnerability - US
Patch;Vendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-24573

Synaptics Pointing Device Driver Vulnerability - US
Broken Link

Jump to

Vulnerability Details : CVE-2018-16098

Products affected by CVE-2018-16098

Exploit prediction scoring system (EPSS) score for CVE-2018-16098

CVSS scores for CVE-2018-16098

CWE ids for CVE-2018-16098

References for CVE-2018-16098