CVE-2022-1890 : A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privilege

A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

Published 2023-01-26 21:15:25

Updated 2023-02-03 19:50:25

Source Lenovo Group Ltd.

View at NVD, CVE.org

Vulnerability category: OverflowMemory CorruptionExecute code

Products affected by CVE-2022-1890

Lenovo » Thinkbook 14-iil Firmware
Versions before (<) djcn28ww
cpe:2.3:o:lenovo:thinkbook_14-iil_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkbook 14-iil » Version: N/A
Lenovo » Thinkbook 14-iml Firmware
Versions before (<) cjcn38ww
cpe:2.3:o:lenovo:thinkbook_14-iml_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkbook 14-iml » Version: N/A
Lenovo » Thinkbook 15-iil Firmware
Versions before (<) djcn28ww
cpe:2.3:o:lenovo:thinkbook_15-iil_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkbook 15-iil » Version: N/A
Lenovo » Thinkbook 15-iml Firmware
Versions before (<) cjcn38ww
cpe:2.3:o:lenovo:thinkbook_15-iml_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkbook 15-iml » Version: N/A
Lenovo » Yoga C640-13iml Firmware
Versions before (<) chcn28ww
cpe:2.3:o:lenovo:yoga_c640-13iml_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Yoga C640-13iml » Version: N/A
Lenovo » Yoga C640-13iml Lte Firmware
Versions before (<) chcn28ww
cpe:2.3:o:lenovo:yoga_c640-13iml_lte_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Yoga C640-13iml Lte » Version: N/A

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	Lenovo Group Ltd.
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-122 Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Assigned by: psirt@lenovo.com (Secondary)
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

Jump to