Lenovo update for Intel Chipset Software Installation Utility

1) Untrusted search path

EUVDB-ID: #VU104107

Risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-36291

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Intel Chipset Device Software for Windows 11 (Version 21H2 or later) - ThinkPad X1 Fold 16 Gen 1 (Type 21ES, 21ET): All versions

Intel Chipset Device Software for Windows 11 (Version 21H2 or later), 10 (Version 1809 or Later) - ThinkPad: All versions

Intel Chipset Device for Windows 11 (Version 22H2 or later), 10 (Version 21H2 or later) - ThinkPad P16v Gen 2 (Type 21KX, 21KY): All versions

ThinkEdge SE30: All versions

ThinkSmart Hub Zoom: All versions

ThinkSmart Hub Teams: All versions

ThinkCentre M90n-1: All versions

ThinkPad P16v Gen 2 21KY: All versions

ThinkPad P16v Gen 2 21KX: All versions

ThinkPad P15s Gen 1 20T5: All versions

ThinkPad P15s Gen 1 20T4: All versions

ThinkStation P3 Ultra Workstation: All versions

ThinkPad X13 20T3: All versions

ThinkPad X13 20T2: All versions

ThinkPad X1 Fold 16 Gen 1 21ET: All versions

ThinkPad X1 Fold 16 Gen 1 21ES: All versions

ThinkPad T14s 20T1: All versions

ThinkPad T14s 20T0: All versions

ThinkSmart Core IP Controller Kit & Bar 180: All versions

ThinkSmart Core Device: Zoom Rooms: All versions

ThinkSmart Core Device: Basic: All versions

ThinkSmart Core Device for Poly: All versions

ThinkSmart Core Device for Logitech: All versions

ThinkSmart Core Controller Kit & Bar 180: All versions

ThinkSmart Core & ThinkSmart Controller Kit: Zoom Rooms: All versions

ThinkSmart Core & ThinkSmart Controller Kit: Microsoft Teams Rooms: All versions

ThinkSmart Core & ThinkSmart Controller Full Room Kit: Zoom Rooms: All versions

ThinkSmart Core & ThinkSmart Controller Full Room Kit: Microsoft Teams Rooms: All versions

ThinkSmart Core & IP Controller Kit: Zoom Rooms: All versions

ThinkSmart Core & IP Controller Kit: Microsoft Teams Rooms/Zoom Rooms: All versions

ThinkSmart Core & IP Controller Kit: Microsoft Teams Rooms: All versions

ThinkSmart Core & IP Controller Full Room Kit: Zoom Rooms: All versions

ThinkSmart Core & IP Controller Full Room Kit: Microsoft Teams Rooms: All versions

ThinkPad T15 20S7: All versions

ThinkPad T15 20S6: All versions

ThinkPad T14 Gen 1 20S3: All versions

ThinkPad T14 Gen 1 20S2: All versions

ThinkPad T14 Gen 1 20S1: All versions

ThinkPad T14 Gen 1 20S0: All versions

ThinkPad P14s Gen 1 20S5: All versions

ThinkPad P14s Gen 1 20S4: All versions

Intel Chipset Driver for Windows 10 (Version 22H2), 11 (Version 22H2 or Later) - ThinkStation P3 Ultra: before 10.1.19600.8418

Intel Chipset Driver for Windows 10 IoT (64-bit) , Windows 11 IoT (64-bit) - ThinkSmart Hub Teams, ThinkSmart Hub Zoom: before 10.1.24.6

Intel Chipset Driver for Windows IoT 11 (64-bit) - ThinkSmart Core: before 10.1.24.6

Intel Chipset Driver for Windows IoT 10 (64-bit) - ThinkSmart Hub Zoom: before 10.1.24.6

Intel Chipset Driver for Windows 10 IoT (64-bit), Windows 11 IoT 64bit - ThinkSmart Core: before 10.1.24.6

Intel Chipset Driver for Windows IoT 10 (64-bit) - ThinkSmart Hub Teams: before 10.1.24.6

Intel Chipset Driver for Windows IoT 10 (64-bit) - ThinkSmart Core: before 10.1.24.6

Intel Chipset Driver for Windows 10 (64-bit), Windows 10 IoT (64-bit), Windows 11 IoT 64bit - ThinkEdge SE30: before 10.1.24.6

Intel Chipset Driver for Windows 10 64-bit (Version 1709, 1803) - ThinkCentre M90n-1: before 10.1.24.6

Intel Chipset Driver for Windows 10 IOT 64-bit - ThinkCentre M90n-1: before 10.1.24.6

CPE2.3

• cpe:2.3:h:lenovo:intel_chipset_device_software_for_windows_11_version_21h2_or_later_-_thinkpad_x1_fold_16_gen_1_type_21es_21et:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_device_software_for_windows_11_version_21h2_or_later_10_version_1809_or_later_-_thinkpad:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_device_for_windows_11_version_22h2_or_later_10_version_21h2_or_later_-_thinkpad_p16v_gen_2_type_21kx_21ky:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkedge_se30:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_hub_zoom:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_hub_teams:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkcentre_m90n-1:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_p16v_gen_2_21ky:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_p16v_gen_2_21kx:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_p15s_gen_1_20t5:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_p15s_gen_1_20t4:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkstation_p3_ultra_workstation:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_x13_20t3:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_x13_20t2:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_x1_fold_16_gen_1_21et:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_x1_fold_16_gen_1_21es:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_t14s_20t1:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_t14s_20t0:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_ip_controller_kit_and_bar_180:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_device_zoom_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_device_basic:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_device_for_poly:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_device_for_logitech:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_controller_kit_and_bar_180:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_thinksmart_controller_kit_zoom_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_thinksmart_controller_kit_microsoft_teams_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_thinksmart_controller_full_room_kit_zoom_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_thinksmart_controller_full_room_kit_microsoft_teams_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_ip_controller_kit_zoom_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_ip_controller_kit_microsoft_teams_rooms_zoom_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_ip_controller_kit_microsoft_teams_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_ip_controller_full_room_kit_zoom_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinksmart_core_and_ip_controller_full_room_kit_microsoft_teams_rooms:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_t15_20s7:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_t15_20s6:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_t14_gen_1_20s3:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_t14_gen_1_20s2:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_t14_gen_1_20s1:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_t14_gen_1_20s0:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_p14s_gen_1_20s5:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:thinkpad_p14s_gen_1_20s4:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_10_version_22h2_11_version_22h2_or_later_-_thinkstation_p3_ultra:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_10_iot_64-bit_windows_11_iot_64-bit_-_thinksmart_hub_teams_thinksmart_hub_zoom:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_iot_11_64-bit_-_thinksmart_core:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_iot_10_64-bit_-_thinksmart_hub_zoom:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_10_iot_64-bit_windows_11_iot_64bit_-_thinksmart_core:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_iot_10_64-bit_-_thinksmart_hub_teams:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_iot_10_64-bit_-_thinksmart_core:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_10_64-bit_windows_10_iot_64-bit_windows_11_iot_64bit_-_thinkedge_se30:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_10_64-bit_version_1709_1803_-_thinkcentre_m90n-1:*:*:*:*:*:*:*:*
• cpe:2.3:h:lenovo:intel_chipset_driver_for_windows_10_iot_64-bit_-_thinkcentre_m90n-1:*:*:*:*:*:*:*:*

External links

https://support.lenovo.com/us/en/product_security/LEN-178469

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.