CVE-2023-4028 - A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code

Back Back to CVE browser

MEDIUM

A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code

Published Aug 17, 2023

6.7

MEDIUM

CVSS 3.1

EPSS 0.19%

Description

A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

Vendor Lenovo Product Lenovo Notebook Default
unaffected
- Version
  various
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Lenovo

Lenovo Notebook

unaffected

Version	Status	Constraints
various	affected	-

Vendor Lenovo Product 13w Yoga Default
n/a
- Version
  82s1
  Status
  affected
  Constraints
  -
- Version
  82s2
  Status
  affected
  Constraints
  -
Vendor Lenovo Product 13w Yoga Gen 2 Default
n/a
- Version
  82y2
  Status
  affected
  Constraints
  -
- Version
  82yr
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Flex 5-14are05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Flex 5-14iil05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Flex 5-14itl05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Flex 5-15alc05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Flex 5-15iil05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Flex 5-15itl05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Flex 7 14iau7 Firmware Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Flex 7 14iru8 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad 1-11ada05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad 1-11igl05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad 1-14ada05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad 1-14igl05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad 5-14alc05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad 5-15alc05 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad Flex 5 14abr8 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad Flex 5 14alc7 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad Flex 5 14iau7 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad Flex 5 14iru8 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad Flex 5 16abr8 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad Flex 5 16alc7 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad Flex 5 16iau7 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Ideapad Flex 5 16iru8 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Thinkbook 13s G2 Are Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Thinkbook 13s G2 Itl Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Thinkbook 13s G3 Acn Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Thinkbook 13s G4 Iap Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Thinkbook 13x G2 Iap Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Thinkbook 14s G2 Itl Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -
Vendor Lenovo Product Yoga 9-15imh5 Default
n/a
- Version
  0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Lenovo

13w Yoga

n/a

Version	Status	Constraints
82s1	affected	-
82s2	affected	-

Lenovo

13w Yoga Gen 2

n/a

Version	Status	Constraints
82y2	affected	-
82yr	affected	-

Lenovo

Flex 5-14are05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Flex 5-14iil05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Flex 5-14itl05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Flex 5-15alc05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Flex 5-15iil05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Flex 5-15itl05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Flex 7 14iau7 Firmware

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Flex 7 14iru8

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad 1-11ada05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad 1-11igl05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad 1-14ada05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad 1-14igl05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad 5-14alc05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad 5-15alc05

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad Flex 5 14abr8

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad Flex 5 14alc7

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad Flex 5 14iau7

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad Flex 5 14iru8

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad Flex 5 16abr8

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad Flex 5 16alc7

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad Flex 5 16iau7

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Ideapad Flex 5 16iru8

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Thinkbook 13s G2 Are

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Thinkbook 13s G2 Itl

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Thinkbook 13s G3 Acn

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Thinkbook 13s G4 Iap

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Thinkbook 13x G2 Iap

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Thinkbook 14s G2 Itl

n/a

Version	Status	Constraints
0	affected	-

Lenovo

Yoga 9-15imh5

n/a

Version	Status	Constraints
0	affected	-

Remediation

Vendor solution

Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-134879.

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-53921
Advisory
https://support.lenovo.com/us/en/product_security/LEN-134879
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-53921		Advisory
https://support.lenovo.com/us/en/product_security/LEN-134879		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner lenovo

Published Aug 17, 2023

Updated Oct 8, 2024

Reserved Jul 31, 2023

Link CVE-2023-4028

CISA Vulnrichment

Updated Oct 8, 2024

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2023-4028

Red Hat

Severity n/a

Public date n/a

Links CVE-2023-4028

ENISA EUVD

Assigner lenovo

Published Aug 17, 2023

Updated Oct 8, 2024

Exploited since n/a

Link EUVD-2023-53921

EUVD-2023-53921