Lucene search

LenovoCVE-2017-3767

HistoryNov 13, 2017 - 4:29 p.m.

CVE-2017-3767

2017-11-1316:29:00

lenovo

web.nvd.nist.gov

vulnerability

local privilege escalation

realtek audio driver

lenovo thinkpad

code execution

administrative privileges

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad products. An attacker with local privileges could execute code with administrative privileges.

Affected configurations

Nvd

Node

lenovothinkpad_10Match-

lenovothinkpad_11eMatch-

lenovothinkpad_13Match-

lenovothinkpad_l450Match-

lenovothinkpad_l460Match-

lenovothinkpad_l470_kblMatch-

lenovothinkpad_l470_sklMatch-

lenovothinkpad_l560Match-

lenovothinkpad_p50Match-

lenovothinkpad_p50sMatch-

lenovothinkpad_p51sMatch-

lenovothinkpad_p70Match-

lenovothinkpad_p71Match-

lenovothinkpad_s1Match-

lenovothinkpad_s1_yogaMatch-

lenovothinkpad_s1_yoga_12Match-

lenovothinkpad_s2Match-

lenovothinkpad_t440Match-

lenovothinkpad_t440pMatch-

lenovothinkpad_t440sMatch-

lenovothinkpad_t450Match-

lenovothinkpad_t450sMatch-

lenovothinkpad_t460Match-

lenovothinkpad_t460pMatch-

lenovothinkpad_t460sMatch-

lenovothinkpad_t470Match-

lenovothinkpad_t470pMatch-

lenovothinkpad_t470s_sklMatch-

lenovothinkpad_t540pMatch-

lenovothinkpad_t550Match-

lenovothinkpad_t560Match-

lenovothinkpad_t570Match-

lenovothinkpad_w540Match-

lenovothinkpad_w541Match-

lenovothinkpad_w550sMatch-

lenovothinkpad_x1_carbonMatch-

lenovothinkpad_x1_tabletMatch-

lenovothinkpad_x1_yogaMatch-

lenovothinkpad_x1cMatch-

lenovothinkpad_x240Match-

lenovothinkpad_x240sMatch-

lenovothinkpad_x250Match-

lenovothinkpad_x260Match-

lenovothinkpad_x270_kblMatch-

lenovothinkpad_x270_sklMatch-

lenovothinkpad_yoga_11eMatch-

AND

realtekaudio_driver_firmwareRange<6.0.1.8224

VendorProductVersionCPE
lenovothinkpad_10-cpe:2.3:h:lenovo:thinkpad_10:-:*:*:*:*:*:*:*
lenovothinkpad_11e-cpe:2.3:h:lenovo:thinkpad_11e:-:*:*:*:*:*:*:*
lenovothinkpad_13-cpe:2.3:h:lenovo:thinkpad_13:-:*:*:*:*:*:*:*
lenovothinkpad_l450-cpe:2.3:h:lenovo:thinkpad_l450:-:*:*:*:*:*:*:*
lenovothinkpad_l460-cpe:2.3:h:lenovo:thinkpad_l460:-:*:*:*:*:*:*:*
lenovothinkpad_l470_kbl-cpe:2.3:h:lenovo:thinkpad_l470_kbl:-:*:*:*:*:*:*:*
lenovothinkpad_l470_skl-cpe:2.3:h:lenovo:thinkpad_l470_skl:-:*:*:*:*:*:*:*
lenovothinkpad_l560-cpe:2.3:h:lenovo:thinkpad_l560:-:*:*:*:*:*:*:*
lenovothinkpad_p50-cpe:2.3:h:lenovo:thinkpad_p50:-:*:*:*:*:*:*:*
lenovothinkpad_p50s-cpe:2.3:h:lenovo:thinkpad_p50s:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	thinkpad_10	-	cpe:2.3:h:lenovo:thinkpad_10:-:::::::*
lenovo	thinkpad_11e	-	cpe:2.3:h:lenovo:thinkpad_11e:-:::::::*
lenovo	thinkpad_13	-	cpe:2.3:h:lenovo:thinkpad_13:-:::::::*
lenovo	thinkpad_l450	-	cpe:2.3:h:lenovo:thinkpad_l450:-:::::::*
lenovo	thinkpad_l460	-	cpe:2.3:h:lenovo:thinkpad_l460:-:::::::*
lenovo	thinkpad_l470_kbl	-	cpe:2.3:h:lenovo:thinkpad_l470_kbl:-:::::::*
lenovo	thinkpad_l470_skl	-	cpe:2.3:h:lenovo:thinkpad_l470_skl:-:::::::*
lenovo	thinkpad_l560	-	cpe:2.3:h:lenovo:thinkpad_l560:-:::::::*
lenovo	thinkpad_p50	-	cpe:2.3:h:lenovo:thinkpad_p50:-:::::::*
lenovo	thinkpad_p50s	-	cpe:2.3:h:lenovo:thinkpad_p50s:-:::::::*

Rows per page:

1-10 of 471

CNA Affected

[
  {
    "product": "Realtek Audio Driver",
    "vendor": "Lenovo Group Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Earlier than 6.0.1.8224"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-15759

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for CVE-2017-3767