Details of VAR-202011-1477

ID

VAR-202011-1477

CVE

CVE-2020-8354

TITLE

Part of Lenovo Vulnerabilities in notebooks

Trust: 0.8

sources: JVNDB: JVNDB-2020-013604

DESCRIPTION

A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrary code execution. Part of Lenovo There are unspecified vulnerabilities in notebooks.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

Trust: 1.62

sources: NVD: CVE-2020-8354 // JVNDB: JVNDB-2020-013604

AFFECTED PRODUCTS

vendor:	lenovo	model:	notebook	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	bios	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	bios	scope:	eq	version:	bios firmware	Trust: 0.8
vendor:	lenovo	model:	bios	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-013604 // NVD: CVE-2020-8354

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-8354
value:	MEDIUM
Trust: 1.0
psirt@lenovo.com:	CVE-2020-8354
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-8354
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201911-1704
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2020-8354
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2020-8354
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.1
Trust: 1.0
psirt@lenovo.com:	CVE-2020-8354
baseSeverity:	MEDIUM
baseScore:	6.4
vectorString:	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.5
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2020-8354
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2020-013604 // CNNVD: CNNVD-201911-1704 // NVD: CVE-2020-8354 // NVD: CVE-2020-8354

PROBLEMTYPE DATA

problemtype:	CWE-367	Trust: 1.0
problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-013604 // NVD: CVE-2020-8354

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-1704

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201911-1704

PATCH

title:	LEN-49266	url:	https://support.lenovo.com/us/en/product_security/LEN-49266	Trust: 0.8
title:	Lenovo Notebook variableServiceSmm driver SMI callback function Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=135441	Trust: 0.6

sources: JVNDB: JVNDB-2020-013604 // CNNVD: CNNVD-201911-1704

EXTERNAL IDS

db:	NVD	id:	CVE-2020-8354	Trust: 2.4
db:	LENOVO	id:	LEN-49266	Trust: 1.6
db:	JVNDB	id:	JVNDB-2020-013604	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-1704	Trust: 0.6

sources: JVNDB: JVNDB-2020-013604 // CNNVD: CNNVD-201911-1704 // NVD: CVE-2020-8354

REFERENCES

url:	https://support.lenovo.com/us/en/product_security/len-49266	Trust: 2.2
url:	https://nvd.nist.gov/vuln/detail/cve-2020-8354	Trust: 1.4

sources: JVNDB: JVNDB-2020-013604 // CNNVD: CNNVD-201911-1704 // NVD: CVE-2020-8354

SOURCES

db:	JVNDB	id:	JVNDB-2020-013604
db:	CNNVD	id:	CNNVD-201911-1704
db:	NVD	id:	CVE-2020-8354

LAST UPDATE DATE

2024-08-14T12:19:38.895000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2020-013604	date:	2021-07-08T08:04:00
db:	CNNVD	id:	CNNVD-201911-1704	date:	2021-05-11T00:00:00
db:	NVD	id:	CVE-2020-8354	date:	2020-11-30T14:42:35.927

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2020-013604	date:	2021-07-08T00:00:00
db:	CNNVD	id:	CNNVD-201911-1704	date:	2019-11-10T00:00:00
db:	NVD	id:	CVE-2020-8354	date:	2020-11-11T18:15:11.843