TOCTOU Vulnerability in Lenovo Vantage SystemUpdate Plugin

CVE-2022-3700

Summary

A Time of Check Time of Use (TOCTOU) vulnerability exists in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier. This flaw potentially enables a local attacker to exploit the timing discrepancies between the file validation check and its subsequent use, resulting in the deletion of arbitrary files on the system. Such vulnerabilities can pose significant risks to the integrity and availability of data, as unauthorized alterations or deletions may occur, leading to operational disruptions.

References