Details of VAR-202306-0278

ID

VAR-202306-0278

CVE

CVE-2022-48188

TITLE

Lenovo Desktops and ThinkStation Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202306-264

DESCRIPTION

A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code

Trust: 0.99

sources: NVD: CVE-2022-48188 // VULMON: CVE-2022-48188

AFFECTED PRODUCTS

vendor:	lenovo	model:	thinkcentre m720q	scope:	lt	version:	m1ukt70a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p520	scope:	lt	version:	s03kt58a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m75s gen 2	scope:	lt	version:	m3bkt30a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m75t gen 2	scope:	lt	version:	m3akt4ca	Trust: 1.0
vendor:	lenovo	model:	v530s-07icb	scope:	lt	version:	m22kt49a	Trust: 1.0
vendor:	lenovo	model:	ideacentre aio 3 21itl7	scope:	lt	version:	o5akt33	Trust: 1.0
vendor:	lenovo	model:	ideacentre aio 3-27itl6	scope:	lt	version:	o5akt33	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m920t	scope:	lt	version:	m1ukt70a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m720e	scope:	lt	version:	m1zkt40a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m920x	scope:	lt	version:	m1ukt70a	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510s-07ick	scope:	lt	version:	m1zkt40a	Trust: 1.0
vendor:	lenovo	model:	v30a-24itl	scope:	lt	version:	o5akt33	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m720s	scope:	lt	version:	m1ukt70a	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510s-07ick	scope:	lt	version:	m30kt28a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p330 tiny	scope:	lt	version:	m1ukt70a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m725s	scope:	lt	version:	m25kt63a	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510s-07icb	scope:	lt	version:	m22kt49a	Trust: 1.0
vendor:	lenovo	model:	ideacentre aio 3-22itl6	scope:	lt	version:	o5akt33	Trust: 1.0
vendor:	lenovo	model:	ideacentre aio 3-24itl6	scope:	lt	version:	o5akt33	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m920s	scope:	lt	version:	m1ukt70a	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510s-07icb	scope:	lt	version:	m22kt48a	Trust: 1.0
vendor:	lenovo	model:	v30a-22itl	scope:	lt	version:	o5akt33	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m75t gen 2	scope:	lt	version:	m46kt30a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p360 ultra	scope:	lt	version:	s0fkt27a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p520c	scope:	lt	version:	s03kt58a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m720t	scope:	lt	version:	m1ukt70a	Trust: 1.0
vendor:	lenovo	model:	v530s-07icr	scope:	lt	version:	m1zkt40a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m920z	scope:	lt	version:	m1mkt55a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m920q	scope:	lt	version:	m1ukt70a	Trust: 1.0
vendor:	lenovo	model:	ideacentre 720-18apr	scope:	lt	version:	m25kt63a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m75s gen 2	scope:	lt	version:	m46kt30a	Trust: 1.0

sources: NVD: CVE-2022-48188

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD:	CVE-2022-48188
value:	HIGH
Trust: 1.0
psirt@lenovo.com:	CVE-2022-48188
value:	MEDIUM
Trust: 1.0
CNNVD:	CNNVD-202306-264
value:	HIGH
Trust: 0.6

NVD:
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
psirt@lenovo.com:
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.1
Trust: 1.0

sources: NVD: CVE-2022-48188 // NVD: CVE-2022-48188 // CNNVD: CNNVD-202306-264

PROBLEMTYPE DATA

problemtype:

CWE-787

Trust: 1.0

sources: NVD: CVE-2022-48188

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202306-264

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202306-264

CONFIGURATIONS

sources: NVD: CVE-2022-48188

PATCH

title:

Lenovo Desktops and ThinkStation Buffer error vulnerability fix

url:

http://123.124.177.30/web/xxk/bdxqbyid.tag?id=241548

Trust: 0.6

sources: CNNVD: CNNVD-202306-264

EXTERNAL IDS

db:	LENOVO	id:	LEN-124495	Trust: 1.7
db:	NVD	id:	CVE-2022-48188	Trust: 1.7
db:	CNNVD	id:	CNNVD-202306-264	Trust: 0.6
db:	VULMON	id:	CVE-2022-48188	Trust: 0.1

sources: VULMON: CVE-2022-48188 // NVD: CVE-2022-48188 // CNNVD: CNNVD-202306-264

REFERENCES

url:	https://support.lenovo.com/us/en/product_security/len-124495	Trust: 1.7
url:	https://cxsecurity.com/cveshow/cve-2022-48188/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2022-48188 // NVD: CVE-2022-48188 // CNNVD: CNNVD-202306-264

SOURCES

db:	VULMON	id:	CVE-2022-48188
db:	NVD	id:	CVE-2022-48188
db:	CNNVD	id:	CNNVD-202306-264

LAST UPDATE DATE

2023-12-18T13:26:33.596000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2022-48188	date:	2023-06-06T00:00:00
db:	NVD	id:	CVE-2022-48188	date:	2023-06-13T21:19:19.467
db:	CNNVD	id:	CNNVD-202306-264	date:	2023-06-14T00:00:00

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2022-48188	date:	2023-06-05T00:00:00
db:	NVD	id:	CVE-2022-48188	date:	2023-06-05T22:15:11.563
db:	CNNVD	id:	CNNVD-202306-264	date:	2023-06-05T00:00:00