What is the CVSS score of CVE-2023-4029?

CVE-2023-4029 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

K14 Type 21Cu Firmware CVE-2023-4029

MEDIUM

Classic Buffer Overflow (CWE-120)

2023-08-17 psirt@lenovo.com

Buffer Overflow RCE Lenovo K14 Type 21Cu Firmware K14 Type 21Cv Firmware Thinkpad S2 Yoga Gen 8 Firmware Thinkpad E14 Gen 3 Firmware Thinkpad E15 Gen 3 Firmware Thinkpad L13 Gen 2 Firmware Thinkpad L13 Gen 3 Firmware Thinkpad L13 Gen 4 Firmware Thinkpad L13 Yoga Gen 4 Firmware Thinkpad L13 Yoga Gen 2 Firmware Thinkpad L13 Yoga Gen 3 Firmware Thinkpad L14 Gen 2 Firmware Thinkpad L14 Gen 3 Firmware Thinkpad L14 Gen 4 Firmware Thinkpad L15 Gen 2 Firmware Thinkpad L15 Gen 3 Firmware Thinkpad L15 Gen 4 Firmware Thinkpad P14S Gen 2 Firmware Thinkpad T14 Gen 2 Firmware Thinkpad T14S Gen 2 Firmware Thinkpad S2 Gen 6 Firmware Thinkpad S2 Gen 7 Firmware Thinkpad S2 Gen 8 Firmware Thinkpad S2 Yoga Gen 6 Firmware Thinkpad S2 Yoga Gen 7 Firmware Thinkpad X13 Gen 2 Firmware

6.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Aug 17, 2023 - 17:15 nvd

MEDIUM 6.7

DescriptionNVD

AnalysisAI

A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code. Affected products include: Lenovo K14 Type 21Cu Firmware, Lenovo K14 Type 21Cv Firmware, Lenovo Thinkpad S2 Yoga Gen 8 Firmware, Lenovo Thinkpad E14 Gen 3 Firmware, Lenovo Thinkpad E15 Gen 3 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.