Memory Leakage Vulnerability in SWSMI_Shadow DXE Driver from Lenovo
CVE-2023-45075

6.7MEDIUM

Key Information:

Vendor
Lenovo
Status
BiOS
Vendor
CVE Published:
8 November 2023

Summary

A memory leakage issue exists in the SWSMI_Shadow DXE driver, which may permit a local attacker with elevated privileges to manipulate NVRAM variables. This vulnerability could lead to potential unauthorized access to sensitive data, emphasizing the need for prompt evaluation and necessary security measures.

Affected Version(s)

BIOS various

References

https://support.lenovo.com/us/en/product_security/LEN-141775

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks Souhardya Sardar of Cyberstanc for reporting this issue.
.