Buffer overflow in Lenovo products - CVE-2022-24350

Vulnerability identifier: #VU75028

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24350

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the Insyde BIOS code. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.

ThinkBook Plus G3 IAP
Yoga Duet 7-13IML05
Yoga 9 14IRP8
IdeaPad Yoga 9 14IAP7
ideapad Yoga 7-15ITL5
ideapad Yoga 7-14ITL5
IdeaPad Yoga 7 16IAP7
Yoga 7 16IAH7
Yoga 7 14IAL7
Lenovo V17 G2-ITL
Lenovo V15 G2-ITL
Lenovo V14-ARE
Lenovo V14 G2-ITL
Yoga Duet 7-13ITL6
ThinkBook Plus G2 ITG
ThinkBook 16 G4+ IAP
ThinkBook 15P G2 ITH
ThinkBook 15 G4 IAP
ThinkBook 15 G3 ITL
ThinkBook 15 G2 ITL
ThinkBook 14s Yoga ITL
ThinkBook 14s Yoga G2 IAP
ThinkBook 14 G4+ IAP
ThinkBook 14 G4 IAP
ThinkBook 14 G3 ITL
ThinkBook 14 G2 ITL
Yoga Slim 7 ProX 14IAH7
ideapad 5-15ARE05
ideapad 5 Pro-16IHU6
ideapad 5 Pro-14ITL6
ideapad 3-15ITL6
ideapad 3-15ITL05
ideapad 3-14ITL6
ideapad 3-14ITL05
Yoga Slim 9 14IAP7
ideapad Yoga Slim 7-15ITL05
ideapad Yoga Slim 7-14ITL05
ideapad Yoga Slim 7-14ARE05
ideapad Yoga Slim 7-13ITL05
ThinkBook 13x ITG
ideapad Yoga Slim 7 Pro-14ITL5
ideapad Yoga Slim 7 Pro-14IHU5 O
ideapad Yoga Slim 7 Pro-14IHU5
IdeaPad Yoga Slim 7 Pro 16IAH7
IdeaPad Yoga Slim 7 Pro 14IAP7
Yoga Slim 7 Pro 14IAH7
ideapad Yoga Slim 7 Carbon 13ITL5
Yoga Slim 7 Carbon 13IRP8
Yoga Slim 7 Carbon 13IAP7
Yoga Slim 6 14IRP8
Yoga Slim 6 14IAP8
Yoga Duet 7-13ITL6-LTE
IdeaPad 5 Pro 16IAH7
Lenovo Legion 5 Pro-16ITH6
Lenovo Legion 5 Pro 16IAH7H
Lenovo Legion 5 Pro 16IAH7
Lenovo Legion 5 15IAH7H
Lenovo Legion 5 15IAH7
ideapad L3-15ITL6
IdeaPad Gaming 3-15IHU6
IdeaPad Gaming 3 16IAH7
IdeaPad Gaming 3 15IAH7
IdeaPad Duet 5 12IAU7
IdeaPad Duet 3 10IGL5
IdeaPad 5-14ITL05
Lenovo Legion 5 Pro-16ITH6H
IdeaPad 5 Pro 14IAP7
IdeaPad 5 15IAL7
IdeaPad 5 14IAL7
IdeaPad 3-17ITL6
IdeaPad 3-17ARE05
IdeaPad 3-15ARE05
IdeaPad 3-14ARE05
IdeaPad 3 17IAU7
IdeaPad 3 15IAU7
IdeaPad 3 14IAU7
IdeaPad 1 15IAU7
IdeaPad 1 14IAU7
Lenovo Slim 7 Carbon 13IRP8
ideapad Slim 7-15ITL05
ideapad Slim 7-14ITL05
ideapad Slim 7-14ARE05
IdeaPad Slim 7 Pro-14IHU5
Lenovo Slim 7 16IAH7
ideapad S540-13ITL
ideapad S540-13ARE
Lenovo V17 G3 IAP
Lenovo V15 G3 IAP
Lenovo V14 G3 IAP
Lenovo Slim 9 14IAP7
Lenovo Slim 7 ProX 14IAH7
ideapad D330-10IGL
Lenovo Slim 7 Carbon 13IAP7
Lenovo Slim 7 14IRP8
Lenovo Slim 7 14IAP7
Lenovo S14 G3 IAP
Lenovo S14 G2 ITL
Lenovo Legion S716IAH7
Lenovo Legion 7-16ITHg6
Legion 7 16IAX7
Lenovo Legion 5-17ITH6H
Lenovo Legion 5-17ITH6
Lenovo Legion 5-15ITH6H
Lenovo Legion 5-15ITH6
RUGGEDCOM APE1808CLA-P
RUGGEDCOM APE1808W10 CC
RUGGEDCOM APE1808W10
RUGGEDCOM APE1808LNX CC
RUGGEDCOM APE1808LNX
RUGGEDCOM APE1808CLA-S5 CC
RUGGEDCOM APE1808CLA-S5
RUGGEDCOM APE1808CLA-S3 CC
RUGGEDCOM APE1808CLA-S3
RUGGEDCOM APE1808CLA-S1 CC
RUGGEDCOM APE1808CLA-S1
RUGGEDCOM APE1808CLA-P CC
RUGGEDCOM APE1808 SAM-L CC
RUGGEDCOM APE1808 SAM-L
RUGGEDCOM APE1808 ELAN CC
RUGGEDCOM APE1808 ELAN
RUGGEDCOM APE1808 CLOUDCONNECT CC
RUGGEDCOM APE1808 CLOUDCONNECT
RUGGEDCOM APE1808 CKP CC
RUGGEDCOM APE1808 CKP
RUGGEDCOM APE1808 ADM CC
RUGGEDCOM APE1808 ADM
Dell G15 5515
Alienware m15 Ryzen Edition R5

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

The vendor plans to release patches in August 2023.

RUGGEDCOM APE1808CLA-P - update to 1.0.212N
RUGGEDCOM APE1808W10 CC - update to 1.0.212N
RUGGEDCOM APE1808W10 - update to 1.0.212N
RUGGEDCOM APE1808LNX CC - update to 1.0.212N
RUGGEDCOM APE1808LNX - update to 1.0.212N
RUGGEDCOM APE1808CLA-S5 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S5 - update to 1.0.212N
RUGGEDCOM APE1808CLA-S3 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S3 - update to 1.0.212N
RUGGEDCOM APE1808CLA-S1 CC - update to 1.0.212N
RUGGEDCOM APE1808CLA-S1 - update to 1.0.212N
RUGGEDCOM APE1808CLA-P CC - update to 1.0.212N
RUGGEDCOM APE1808 SAM-L CC - update to 1.0.212N
RUGGEDCOM APE1808 SAM-L - update to 1.0.212N
RUGGEDCOM APE1808 ELAN CC - update to 1.0.212N
RUGGEDCOM APE1808 ELAN - update to 1.0.212N
RUGGEDCOM APE1808 CLOUDCONNECT CC - update to 1.0.212N
RUGGEDCOM APE1808 CLOUDCONNECT - update to 1.0.212N
RUGGEDCOM APE1808 CKP CC - update to 1.0.212N
RUGGEDCOM APE1808 CKP - update to 1.0.212N
RUGGEDCOM APE1808 ADM CC - update to 1.0.212N
RUGGEDCOM APE1808 ADM - update to 1.0.212N
Dell G15 5515 - update to 1.11.1
Alienware m15 Ryzen Edition R5 - update to 1.12.1

• https://support.lenovo.com/us/en/product_security/LEN-115634

• Multiple vulnerabilities in Lenovo Insyde BIOS firmware
• Multiple vulnerabilities in Dell Client Platform
• Multiple vulnerabilities in Siemens RUGGEDCOM APE1808 Product Family