CVE-2023-4028: Buffer Overflow
Published Aug 17, 2023
·Updated
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
Affected Software
116 affected components
Lenovo 13w Yoga Firmware<jacn38ww
Lenovo 13w Yoga
Lenovo 13w Yoga Gen 2 Firmware<kbcn20ww
Lenovo 13w Yoga Gen 2
Lenovo Ideapad 1-11ada05 Firmware<fqcn29ww
Lenovo Ideapad 1-11ada05
Lenovo Ideapad 1-11igl05 Firmware<dwcn28ww
Lenovo Ideapad 1-11igl05
Lenovo Ideapad 1-14ada05 Firmware<fqcn29ww
Lenovo Ideapad 1-14ada05
Lenovo Ideapad 1-14igl05 Firmware<dwcn28ww
Lenovo Ideapad 1-14igl05
Lenovo Flex 5-14alc05 Firmware<gjcn32ww
Lenovo Flex 5-14alc05
Lenovo Flex 5-14are05 Firmware<eecn43ww
Lenovo Flex 5-14are05
Lenovo Flex 5-14iil05 Firmware<eccn45ww
Lenovo Flex 5-14iil05
Lenovo Flex 5-14itl05 Firmware<fxcn44ww
Lenovo Flex 5-14itl05
Lenovo Flex 5-15alc05 Firmware<gjcn32ww
Lenovo Flex 5-15alc05
Lenovo Flex 5-15iil05 Firmware<eccn45ww
Lenovo Flex 5-15iil05
Lenovo Flex 5-15itl05 Firmware<fxcn44ww
Lenovo Flex 5-15itl05
Lenovo Ideapad Flex 5 14abr8 Firmware<l7cn17ww
Lenovo Ideapad Flex 5 14abr8
Lenovo Ideapad Flex 5 14alc7 Firmware<jccn35ww
Lenovo Ideapad Flex 5 14alc7
Lenovo Ideapad Flex 5 14iau7 Firmware<j7cn44ww
Lenovo Ideapad Flex 5 14iau7
Lenovo Ideapad Flex 5 14iru8 Firmware<l6cn20ww
Lenovo Ideapad Flex 5 14iru8
Lenovo Ideapad Flex 5 16abr8 Firmware<l7cn17ww
Lenovo Ideapad Flex 5 16abr8
Lenovo Ideapad Flex 5 16alc7 Firmware<jccn35ww
Lenovo Ideapad Flex 5 16alc7
Lenovo Ideapad Flex 5 16iau7 Firmware<j7cn44ww
Lenovo Ideapad Flex 5 16iau7
Lenovo Ideapad Flex 5 16iru8 Firmware<l6cn20ww
Lenovo Ideapad Flex 5 16iru8
Lenovo Flex 7 14iru8 Firmware<l6cn20ww
Lenovo Flex 7 14iru8
Lenovo Thinkbook 13s G2 Are Firmware<fvcn28ww
Lenovo Thinkbook 13s G2 Are
Lenovo Thinkbook 13s G2 Itl Firmware<f9cn57ww
Lenovo Thinkbook 13s G2 Itl
Lenovo Thinkbook 13s G3 Acn Firmware<gmcn35ww
Lenovo Thinkbook 13s G3 Acn
Lenovo Thinkbook 13s G4 Iap Firmware<hwcn49ww
Lenovo Thinkbook 13s G4 Iap
Lenovo Thinkbook 13x G2 Iap Firmware<hxcn54ww
Lenovo Thinkbook 13x G2 Iap
Lenovo Thinkbook 14s G2 Itl Firmware<f9cn57ww
Lenovo Thinkbook 14s G2 Itl
Lenovo Yoga 9-15imh5 Firmware<epcn32ww
Lenovo Yoga 9-15imh5
All of the following
Lenovo 13w Yoga Firmware<jacn38ww
Lenovo 13w Yoga
All of the following
Lenovo 13w Yoga Gen 2 Firmware<kbcn20ww
Lenovo 13w Yoga Gen 2
All of the following
Lenovo Ideapad 1-11ada05 Firmware<fqcn29ww
Lenovo Ideapad 1-11ada05
All of the following
Lenovo Ideapad 1-11igl05 Firmware<dwcn28ww
Lenovo Ideapad 1-11igl05
All of the following
Lenovo Ideapad 1-14ada05 Firmware<fqcn29ww
Lenovo Ideapad 1-14ada05
All of the following
Lenovo Ideapad 1-14igl05 Firmware<dwcn28ww
Lenovo Ideapad 1-14igl05
All of the following
Lenovo Flex 5-14alc05 Firmware<gjcn32ww
Lenovo Flex 5-14alc05
All of the following
Lenovo Flex 5-14are05 Firmware<eecn43ww
Lenovo Flex 5-14are05
All of the following
Lenovo Flex 5-14iil05 Firmware<eccn45ww
Lenovo Flex 5-14iil05
All of the following
Lenovo Flex 5-14itl05 Firmware<fxcn44ww
Lenovo Flex 5-14itl05
All of the following
Lenovo Flex 5-15alc05 Firmware<gjcn32ww
Lenovo Flex 5-15alc05
All of the following
Lenovo Flex 5-15iil05 Firmware<eccn45ww
Lenovo Flex 5-15iil05
All of the following
Lenovo Flex 5-15itl05 Firmware<fxcn44ww
Lenovo Flex 5-15itl05
All of the following
Lenovo Ideapad Flex 5 14abr8 Firmware<l7cn17ww
Lenovo Ideapad Flex 5 14abr8
All of the following
Lenovo Ideapad Flex 5 14alc7 Firmware<jccn35ww
Lenovo Ideapad Flex 5 14alc7
All of the following
Lenovo Ideapad Flex 5 14iau7 Firmware<j7cn44ww
Lenovo Ideapad Flex 5 14iau7
All of the following
Lenovo Ideapad Flex 5 14iru8 Firmware<l6cn20ww
Lenovo Ideapad Flex 5 14iru8
All of the following
Lenovo Ideapad Flex 5 16abr8 Firmware<l7cn17ww
Lenovo Ideapad Flex 5 16abr8
All of the following
Lenovo Ideapad Flex 5 16alc7 Firmware<jccn35ww
Lenovo Ideapad Flex 5 16alc7
All of the following
Lenovo Ideapad Flex 5 16iau7 Firmware<j7cn44ww
Lenovo Ideapad Flex 5 16iau7
All of the following
Lenovo Ideapad Flex 5 16iru8 Firmware<l6cn20ww
Lenovo Ideapad Flex 5 16iru8
All of the following
Lenovo Flex 7 14iru8 Firmware<l6cn20ww
Lenovo Flex 7 14iru8
All of the following
Lenovo Thinkbook 13s G2 Are Firmware<fvcn28ww
Lenovo Thinkbook 13s G2 Are
All of the following
Lenovo Thinkbook 13s G2 Itl Firmware<f9cn57ww
Lenovo Thinkbook 13s G2 Itl
All of the following
Lenovo Thinkbook 13s G3 Acn Firmware<gmcn35ww
Lenovo Thinkbook 13s G3 Acn
All of the following
Lenovo Thinkbook 13s G4 Iap Firmware<hwcn49ww
Lenovo Thinkbook 13s G4 Iap
All of the following
Lenovo Thinkbook 13x G2 Iap Firmware<hxcn54ww
Lenovo Thinkbook 13x G2 Iap
All of the following
Lenovo Thinkbook 14s G2 Itl Firmware<f9cn57ww
Lenovo Thinkbook 14s G2 Itl
All of the following
Lenovo Yoga 9-15imh5 Firmware<epcn32ww
Lenovo Yoga 9-15imh5
Remediation
Information
Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-134879.
Event History
Aug 17, 2023
CVE Published
via MITRE·04:48 PM
Data Sourced
via MITRE·04:48 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-4028?
CVE-2023-4028 has a high severity rating due to its potential for local privilege escalation and remote code execution.
2
How do I fix CVE-2023-4028?
To fix CVE-2023-4028, users should update their Lenovo Notebook firmware to the latest version provided by Lenovo.
3
What products are affected by CVE-2023-4028?
CVE-2023-4028 affects specific Lenovo Notebook models, including the Lenovo 13w Yoga Gen 2, Ideapad models, and Flex models.
4
Can CVE-2023-4028 be exploited remotely?
CVE-2023-4028 can only be exploited locally by an attacker with elevated privileges.
5
What is a buffer overflow in the context of CVE-2023-4028?
In the context of CVE-2023-4028, a buffer overflow refers to a vulnerability that allows an attacker to write more data to a buffer than it can hold, potentially allowing arbitrary code execution.