CVE-2020-8337: High severity synaptics audio drivers vulnerability
Published Jun 9, 2020
·Updated
An unquoted search path vulnerability was reported in versions prior to 1.0.83.0 of the Synaptics Smart Audio UWP app associated with the DCHU audio drivers on Lenovo platforms that could allow an administrative user to execute arbitrary code.
Affected Software
83 affected components
Synaptics Smart Audio UWP<1.0.83.0
Lenovo 5-15ikb
Lenovo Air-14 2019
Lenovo C340-14iwl
Lenovo Flex-14iwl
Lenovo S540-14iwl
Lenovo S540-14iwl Touch
Lenovo Thinkpad 11e
Lenovo Thinkpad 13
Lenovo Thinkpad A275
Lenovo ThinkPad A285
Lenovo Thinkpad A475
Lenovo Thinkpad A485
Lenovo Thinkpad E450
Lenovo Thinkpad E450c
Lenovo Thinkpad E455
Lenovo Thinkpad E460
Lenovo Thinkpad E465
Lenovo Thinkpad E470
Lenovo Thinkpad E475
Lenovo Thinkpad E480
Lenovo Thinkpad E485
Lenovo Thinkpad E490
Lenovo Thinkpad E490s
Lenovo Thinkpad E540
Lenovo Thinkpad E545
Lenovo Thinkpad E550
Lenovo Thinkpad E550c
Lenovo Thinkpad E555
Lenovo Thinkpad E560
Lenovo Thinkpad E565
Lenovo Thinkpad E570
Lenovo Thinkpad E575
Lenovo Thinkpad E580
Lenovo Thinkpad E585
Lenovo Thinkpad E590
Lenovo Thinkpad Edge E440
Lenovo Thinkpad Edge E445
Lenovo Thinkpad L380
Lenovo Thinkpad L380 Yoga
Lenovo Thinkpad L390 Yoga
Lenovo Thinkpad L440
Lenovo Thinkpad L450
Lenovo Thinkpad L460
Lenovo Thinkpad L470
Lenovo Thinkpad L480
Lenovo Thinkpad L540
Lenovo Thinkpad L580
Lenovo Thinkpad P1
Lenovo Thinkpad P40
Lenovo Thinkpad P53
Lenovo Thinkpad P73
Lenovo Thinkpad R490
Lenovo Thinkpad R590
Lenovo Thinkpad S1 3rd
Lenovo Thinkpad S1 Yoga 12
Lenovo Thinkpad S2 Yoga 3rd Gen
Lenovo Thinkpad S2 Yoga 4th Gen
Lenovo Thinkpad S3
Lenovo Thinkpad S3-s440
Lenovo Thinkpad S3 3rd Gen
Lenovo Thinkpad S3 Yoga 14
Lenovo Thinkpad S5
Lenovo Thinkpad T450
Lenovo Thinkpad T450s
Lenovo ThinkPad T460
Lenovo ThinkPad T460p
Lenovo Thinkpad T470p
Lenovo Thinkpad X1 Extreme
Lenovo Thinkpad X260
Lenovo Thinkpad X270
Lenovo Thinkpad X380 Yoga
Lenovo Thinkpad Yoga 11e
Lenovo Thinkpad Yoga 11e 3rd Gen
Lenovo Thinkpad Yoga 11e 4th Gen
Lenovo Thinkpad Yoga 11e 5th Gen
Lenovo Thinkpad Yoga 14 460 S3
Lenovo Thinkpad Yoga 370
Lenovo V130-15igm
Lenovo V130-15ikb
Lenovo V310-15igm
Lenovo V330-15igm
Lenovo Yoga 14
Remediation
Information
Update to version 1.0.83.0 (or later) of the Smart Audio app, which installs with the corresponding audio driver version.
Event History
Jun 9, 2020
CVE Published
via MITRE·07:50 PM
Data Sourced
via MITRE·07:50 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-8337?
The severity of CVE-2020-8337 is rated as high with a CVSS score of 6.7.
2
How can I fix the unquoted search path vulnerability in Synaptics Smart Audio UWP app?
To fix the vulnerability, update the Synaptics Smart Audio UWP app to version 1.0.83.0 or newer.
3
Which Lenovo platforms are affected by CVE-2020-8337 vulnerability?
The vulnerability affects Lenovo platforms associated with the DCHU audio drivers.
4
Is an administrative user able to execute arbitrary code due to CVE-2020-8337 vulnerability?
Yes, an administrative user could exploit the vulnerability to execute arbitrary code.