CVE-2022-48188

A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.

Score

CVSS 3.1 7.8 High

Status

Modified - psirt@lenovo.com

Published

2023-06-05

Last modified

2025-01-08

Weaknesses

CWE-787

Affected products

• Ideacentre 510s-07icb Firmware (Lenovo)
• Ideacentre 510s-07ick Firmware (Lenovo)
• Ideacentre 720-18apr Firmware (Lenovo)
• Ideacentre Aio 3-22itl6 Firmware (Lenovo)
• Ideacentre Aio 3-24itl6 Firmware (Lenovo)
• Ideacentre Aio 3-27itl6 Firmware (Lenovo)
• Ideacentre Aio 3 21itl7 Firmware (Lenovo)
• Thinkcentre M720e Firmware (Lenovo)
• Thinkcentre M720q Firmware (Lenovo)
• Thinkcentre M720s Firmware (Lenovo)
• Thinkcentre M720t Firmware (Lenovo)
• Thinkcentre M725s Firmware (Lenovo)
• Thinkcentre M75s Gen 2 Firmware (Lenovo)
• Thinkcentre M75t Gen 2 Firmware (Lenovo)
• Thinkcentre M920q Firmware (Lenovo)
• Thinkcentre M920s Firmware (Lenovo)
• Thinkcentre M920t Firmware (Lenovo)
• Thinkcentre M920x Firmware (Lenovo)
• Thinkcentre M920z Firmware (Lenovo)
• Thinkstation Bios (Lenovo)
• Thinkstation P330 Tiny Firmware (Lenovo)
• Thinkstation P360 Ultra Firmware (Lenovo)
• Thinkstation P520 Firmware (Lenovo)
• Thinkstation P520c Firmware (Lenovo)
• V30a-22itl Firmware (Lenovo)
• V30a-24itl Firmware (Lenovo)
• V530s-07icb Firmware (Lenovo)
• V530s-07icr Firmware (Lenovo)

References

• https://support.lenovo.com/us/en/product_security/LEN-124495