Medium severity · published Nov 8, 2023
CVE-2023-45078
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I3
Ideacentre 3-07ada05 Firmware · Lenovo
before o4fkt39a · source: NVD
I3
Ideacentre 3-07imb05 Firmware · Lenovo
before m2vkt21a · source: NVD
I5
Ideacentre 5-14iob6 Firmware · Lenovo
before m3gkt3da · source: NVD
IC
Ideacentre C5-14imb05 Firmware · Lenovo
before o4hkt3ca · source: NVD
IC
Ideacentre Creator 5-14iob6 Firmware · Lenovo
before m3gkt3da · source: NVD
IG
Ideacentre G5-14amr05 Firmware · Lenovo
before o4zkt2ba · source: NVD
IG
Ideacentre G5-14imb05 Firmware · Lenovo
before o4hkt3ca; before o4hkt3ca · source: NVD
IG
Ideacentre Gaming 5-14iob6 Firmware · Lenovo
before m3gkt3da · source: NVD
IM
Ideacentre Mini 5 01iaq7 Firmware · Lenovo
before o53kt10a · source: NVD
IM
Ideacentre Mini 5-01imh05 Firmware · Lenovo
before o4ekt1ba · source: NVD
LT
Legion T7-34imz5 Firmware · Lenovo
before o5fkt17a · source: NVD
TM
Thinkcentre M625q Firmware · Lenovo
before m1wkt52a · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-45078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-45078
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-141775
More from Ideacentre 3-07ada05 Firmware
7.8
CVE-2022-48181
An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute…
6.7
CVE-2023-45079
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45077
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45076
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45075
A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables