CVE-2022-1890: Buffer Overflow
First published: Mon Jan 23 2023(Updated: )
A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
Credit: psirt@lenovo.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lenovo Thinkbook 14 IMl Firmware | <cjcn38ww | |
| Lenovo Thinkbook 14 IMl | ||
| Lenovo ThinkBook 14 iil Firmware | <djcn28ww | |
| Lenovo ThinkBook 14 iil | ||
| Lenovo Thinkbook 15-iil Firmware | <djcn28ww | |
| Lenovo Thinkbook 15-iil Firmware | ||
| Lenovo ThinkBook 15-IML Firmware | <cjcn38ww | |
| Lenovo ThinkBook 15 IML | ||
| Lenovo Yoga C640-13IML LTE Firmware | <chcn28ww | |
| Lenovo Yoga C640-13IML LTE Firmware | ||
| Lenovo C640-IML Firmware | <chcn28ww | |
| Lenovo Yoga C640-13IML LTE Firmware |
Remedy
Update system firmware to the version (or newer) indicated for your model in the product Impact section of LEN-91369
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this Lenovo Notebook product buffer overflow vulnerability?
The vulnerability ID is CVE-2022-1890.
What is the severity level of CVE-2022-1890?
The severity level of CVE-2022-1890 is high (CVSS score: 7.8).
Which Lenovo Notebook products are affected by CVE-2022-1890?
The Lenovo Thinkbook 14-iml Firmware (up to cjcn38ww) and Lenovo Thinkbook 15-iml Firmware (up to cjcn38ww) are affected.
How can an attacker exploit CVE-2022-1890?
An attacker with local privileges can exploit CVE-2022-1890 to execute arbitrary code.
Is the Lenovo Thinkbook 14-iil and Lenovo Thinkbook 15-iil vulnerable to CVE-2022-1890?
No, the Lenovo Thinkbook 14-iil and Lenovo Thinkbook 15-iil are not vulnerable to CVE-2022-1890.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/author
- agent/references
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/lenovo
- canonical/lenovo thinkbook 14 iml firmware
- canonical/lenovo thinkbook 14 iml
- canonical/lenovo thinkbook 14 iil firmware
- canonical/lenovo thinkbook 14 iil
- canonical/lenovo thinkbook 15-iil firmware
- canonical/lenovo thinkbook 15-iml firmware
- canonical/lenovo thinkbook 15 iml
- canonical/lenovo yoga c640-13iml lte firmware
- canonical/lenovo c640-iml firmware