Sign-up

ID

VAR-201903-1019


CVE

CVE-2018-15532


TITLE

Synaptics TouchPad Information disclosure vulnerability in driver

Trust: 0.8

sources: JVNDB: JVNDB-2018-015098

DESCRIPTION

SynTP.sys in Synaptics Touchpad drivers before 2018-06-06 allows local users to obtain sensitive information about freed kernel addresses. Synaptics TouchPad The driver contains an information disclosure vulnerability.Information may be obtained. Synaptics TouchPad is prone to a local information-disclosure vulnerability. Attackers can exploit this issue to read portions of kernel memory, resulting in a privilege escalation

Trust: 1.89

sources: NVD: CVE-2018-15532 // JVNDB: JVNDB-2018-015098 // BID: 106799

AFFECTED PRODUCTS

vendor:hpmodel:synaptics touchpad driverscope:lteversion:2018-06-06

Trust: 1.0

vendor:synapticsmodel:touchpad driverscope:eqversion:2018/06/06

Trust: 0.8

vendor:synapticsmodel:touchpad driversscope:eqversion:0

Trust: 0.3

vendor:synapticsmodel:pointing device driverscope:eqversion:0

Trust: 0.3

vendor:lenovomodel:thinkpadscope:eqversion:0

Trust: 0.3

vendor:lenovomodel:ideapadscope:eqversion:0

Trust: 0.3

sources: BID: 106799 // JVNDB: JVNDB-2018-015098 // NVD: CVE-2018-15532

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15532
value: LOW

Trust: 1.0

NVD: CVE-2018-15532
value: LOW

Trust: 0.8

CNNVD: CNNVD-201901-898
value: LOW

Trust: 0.6

nvd@nist.gov: CVE-2018-15532
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

nvd@nist.gov: CVE-2018-15532
baseSeverity: LOW
baseScore: 3.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.0
impactScore: 1.4
version: 3.0

Trust: 1.8

sources: JVNDB: JVNDB-2018-015098 // CNNVD: CNNVD-201901-898 // NVD: CVE-2018-15532

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2018-015098 // NVD: CVE-2018-15532

THREAT TYPE

local

Trust: 0.9

sources: BID: 106799 // CNNVD: CNNVD-201901-898

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201901-898

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-015098

PATCH
title:TouchPad Familyurl:https://www.synaptics.com/products/touchpad-family
Trust: 0.8
title:Synaptics TouchPad Driver - SynTP.sys can leak freed pointers to kernel memoryurl:https://www.synaptics.com/sites/default/files/touchpad-driver-security-brief-20190124.pdf
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-015098

EXTERNAL IDS
db:LENOVOid:LEN-23156
Trust: 2.7
db:NVDid:CVE-2018-15532
Trust: 2.7
db:BIDid:106799
Trust: 1.9
db:JVNDBid:JVNDB-2018-015098
Trust: 0.8
db:NSFOCUSid:43909
Trust: 0.6
db:CNNVDid:CNNVD-201901-898
Trust: 0.6
sources:
            
            
            BID: 106799 // 
            
            
            
            JVNDB: JVNDB-2018-015098 // 
            
            
            
            CNNVD: CNNVD-201901-898 // 
            
            
            
            NVD: CVE-2018-15532

REFERENCES
url:https://support.lenovo.com/us/en/product_security/len-23156
Trust: 2.4
url:https://www.synaptics.com/sites/default/files/touchpad-driver-security-brief-20190124.pdf
Trust: 1.9
url:https://www.synaptics.com/products/touchpad-family
Trust: 1.6
url:http://www.securityfocus.com/bid/106799
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2018-15532
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15532
Trust: 0.8
url:https://support.lenovo.com/us/zh/product_security/len-23156
Trust: 0.6
url:http://www.nsfocus.net/vulndb/43909
Trust: 0.6
url:https://www.synaptics.com/
Trust: 0.3
url:https://support.lenovo.com/in/en/product_security/len-23156
Trust: 0.3
url:https://support.lenovo.com/ie/en/product_security/len-23156
Trust: 0.3
sources:
            
            
            BID: 106799 // 
            
            
            
            JVNDB: JVNDB-2018-015098 // 
            
            
            
            CNNVD: CNNVD-201901-898 // 
            
            
            
            NVD: CVE-2018-15532

CREDITS
Senior Security Consultant for IOActive,Enrique Nissim
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201901-898

SOURCES
db:BIDid:106799
db:JVNDBid:JVNDB-2018-015098
db:CNNVDid:CNNVD-201901-898
db:NVDid:CVE-2018-15532

LAST UPDATE DATE
2024-11-23T22:48:25.461000+00:00

SOURCES UPDATE DATE
db:BIDid:106799date:2019-01-24T00:00:00
db:JVNDBid:JVNDB-2018-015098date:2019-04-25T00:00:00
db:CNNVDid:CNNVD-201901-898date:2019-08-23T00:00:00
db:NVDid:CVE-2018-15532date:2024-11-21T03:51:00.903

SOURCES RELEASE DATE
db:BIDid:106799date:2019-01-24T00:00:00
db:JVNDBid:JVNDB-2018-015098date:2019-04-25T00:00:00
db:CNNVDid:CNNVD-201901-898date:2019-01-25T00:00:00
db:NVDid:CVE-2018-15532date:2019-03-21T16:00:21.310