CVE-2023-4029

MEDIUM

Lenovo ThinkPad Firmware - Authenticated Buffer Overflow in BoardUpdateAcpiDxe Driver

Title source: llm

Description

A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

References (1)

Core 1

Core References

Vendor Advisory

https://support.lenovo.com/us/en/product_security/LEN-134879

Scores

CVSS v3 6.7

EPSS 0.0018

EPSS Percentile 8.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-120

Status published

Products (26)

lenovo/k14_type_21cu_firmware < 1.12

lenovo/k14_type_21cv_firmware < 1.12

lenovo/thinkpad_e14_gen_3_firmware < 1.15

lenovo/thinkpad_e15_gen_3_firmware < 1.15

lenovo/thinkpad_l13_gen_2_firmware < 1.30

lenovo/thinkpad_l13_gen_3_firmware < 1.19

lenovo/thinkpad_l13_gen_4_firmware < 1.10

lenovo/thinkpad_l13_yoga_gen_2_firmware < 1.30

lenovo/thinkpad_l13_yoga_gen_3_firmware < 1.19

lenovo/thinkpad_l13_yoga_gen_4_firmware < 1.10

... and 16 more

Published Aug 17, 2023

Tracked Since Feb 18, 2026