Insecure DLL loading in Lenovo System Interface Foundation - CVE-2020-8324
Published: April 17, 2020 / Updated: April 27, 2020
Vulnerability identifier: #VU27003
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-8324
CWE-ID: CWE-427
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to the application loads DLL libraries in an insecure manner in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation component for Lenovo Vantage. A local user can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.
Affected software
Lenovo System Interface Foundation
How to mitigate CVE-2020-8324
Install updates from vendor's website.
Lenovo System Interface Foundation - update to 1.2.184.31