« Volver al listado

CVE-2022-1891

Estado: ModificadaAlta (7.8)—

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (6)

Lenovo — Thinkbook 14-iil FirmwareLenovo — Thinkbook 14-iml FirmwareLenovo — Thinkbook 15-iil FirmwareLenovo — Thinkbook 15-iml FirmwareLenovo — Yoga C640-13iml FirmwareLenovo — Yoga C640-13iml LTE Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1891",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-1891",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-02T14:34:12.315495Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@lenovo.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@lenovo.com",
      "affectedData": [
        {
          "vendor": "Lenovo",
          "product": "BIOS",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-01-26T21:15:25.193",
  "references": [
    {
      "url": "https://support.lenovo.com/us/en/product_security/LEN-91369",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@lenovo.com"
    },
    {
      "url": "https://support.lenovo.com/us/en/product_security/LEN-91369",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@lenovo.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code."
    },
    {
      "lang": "es",
      "value": "Un desbordamiento de búfer en el controlador SystemLoadDefaultDxe en algunos productos portátiles Lenovo puede permitir que un atacante con privilegios locales ejecute código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T04:23:17.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lenovo:thinkbook_14-iml_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "495AE9CC-8F17-40CF-98AA-8CD8DAF49E29",
              "versionEndExcluding": "cjcn38ww"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:thinkbook_14-iml:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B6839816-92D3-4698-893E-DF7D99C487C1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lenovo:thinkbook_14-iil_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "036C342E-1F74-4B63-A06B-06157A6797E8",
              "versionEndExcluding": "djcn28ww"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:thinkbook_14-iil:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E1CF3129-19E2-4649-B0E8-79EB5B3EB1F7"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lenovo:thinkbook_15-iil_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F4947120-80EC-4DD8-B386-80FF9E749B76",
              "versionEndExcluding": "djcn28ww"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:thinkbook_15-iil:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F4CEE028-83AF-4AFD-A3F1-C0DA6070FC48"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lenovo:thinkbook_15-iml_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8BF015D2-2202-4330-A1F2-9E319A0CFC73",
              "versionEndExcluding": "cjcn38ww"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:thinkbook_15-iml:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CA4C15FE-8601-4948-BCF4-5A4A5E307759"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lenovo:yoga_c640-13iml_lte_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3FA80A4-ED4B-40E1-AC05-F355A880C374",
              "versionEndExcluding": "chcn28ww"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:yoga_c640-13iml_lte:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6E2E3608-02DC-40C8-A92D-04E50B81F534"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:lenovo:yoga_c640-13iml_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E747094D-17B6-4954-A346-46934230091B",
              "versionEndExcluding": "chcn28ww"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:yoga_c640-13iml:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "709C368C-A159-45F9-BD23-ED07A5CF08A2"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@lenovo.com"
}