Vulnerability-Lookup

BDU:2022-04455 (CVE-2022-34884)

Vulnerability from fstec – Published: 2022-07-18 – Updated: 2022-07-18 – View on bdu.fstec.ru Fixed

Title

Уязвимость подсистемы Remote Presence микропрограммного обеспечения стоечных серверов Lenovo ThinkSystem, рабочих станций Lenovo ThinkStation, промышленных компьютеров Lenovo ThinkEdge, программно-аппаратной системы Lenovo ThinkAgile, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость подсистемы Remote Presence микропрограммного обеспечения стоечных серверов Lenovo ThinkSystem, рабочих станций Lenovo ThinkStation, промышленных компьютеров Lenovo ThinkEdge, программно-аппаратной системы Lenovo ThinkAgile связана с выходом операции за границы буфера в памяти. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании

Severity

7.8 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-119 - Выход операции за границы буфера в памяти

Aliases

CVE-2022-34884, LEN-87734

References

1 reference

URL
https://support.lenovo.com/us/en/product_security/LEN-87734

Impacted products

98 products from 1 vendor

Vendors

Lenovo Group Limited

Products

VX3331 Certified Node, HX Enclosure Certified Node, HX1021 Edge Certified Node 3yr, HX1320 Appliance, HX1321 Certified Node, HX1520-R Appliance, HX1521-R Certified Node, HX2320-E Appliance, HX2321 Certified Node, HX2720-E Appliance, HX3320 Appliance, HX3321 Certified Node, HX3375 Appliance, HX3376 Certified Node, HX3520-G Appliance, HX3521-G Certified Node, HX3720 Appliance, HX3721 Certified Node, HX5520 Appliance, HX5520-C Appliance, HX5521 Certified Node, HX5521-C Certified Node, HX7520 Appliance, HX7521 Certified Node, HX7820 Appliance, HX7821 Certified Node, MX Edge Appliance - MX1020, MX3330-F All-flash Appliance, MX3330-H Hybrid Appliance, MX3331-F All-flash Certified node, MX3331-H Hybrid Certified node, MX3530 F All flash Appliance, MX3530-H Hybrid Appliance, MX3531 H Hybrid Certified node, MX3531-F All-flash Certified node, ThinkAgile MX1021 on SE350, VX 1SE Certified Node, VX 2U4N Certified Node, VX 4U Certified Node, VX1320, VX2320, VX2330 Appliance, VX3320, VX3330 Appliance, VX3520-G, VX3530-G Appliance, VX3720, VX5520, VX5530 Appliance, VX7320 N, VX7330 Appliance, VX7520, VX7520 N, VX7530 Appliance, VX7531 Certified Node, VX7820, SE450, P920 Rack Workstation, SD530, SD630 V2 (ThinkSystem), SD650 DWC Dual Node Tray, SD650 v2, SD650-N V2, SE350, SN550, SN550 V2, SN850, SR150, SR158, SR250, SR250 V2, SR258, SR258 V2, SR530, SR550, SR570, SR590, SR630, SR630 V2, SR645, SR650, SR650 V2, SR665, SR670, SR670 V2, SR850, SR850 V2, SR850P, SR860, SR860 V2, SR950, ST250, ST250 V2, ST258, ST258 V2, ST550, ST650 V2, ST658 V2

Versions

до 1.80 AFBT20N (VX3331 Certified Node), до 5.20 TEI3C8M (HX Enclosure Certified Node), до 3.60 TEI386M (HX1021 Edge Certified Node 3yr), до 8.40-cdi394n (HX1320 Appliance), до 8.40-cdi394n (HX1321 Certified Node), до 8.40-cdi394n (HX1520-R Appliance), до 8.40-cdi394n (HX1521-R Certified Node), до 8.40-cdi394n (HX2320-E Appliance), до 8.40-cdi394n (HX2321 Certified Node), до 5.20 TEI3C8M (HX2720-E Appliance), до 8.40-cdi394n (HX3320 Appliance), до 8.40-cdi394n (HX3321 Certified Node), до 4.10 D8BT38L (HX3375 Appliance), до 4.10 D8BT38L (HX3376 Certified Node), до 8.40-cdi394n (HX3520-G Appliance), до 8.40-cdi394n (HX3521-G Certified Node), до 5.20 TEI3C8M (HX3720 Appliance), до 5.20 TEI3C8M (HX3721 Certified Node), до 8.40-cdi394n (HX5520 Appliance), до 8.40-cdi394n (HX5520-C Appliance), до 8.40-cdi394n (HX5521 Certified Node), до 8.40-cdi394n (HX5521-C Certified Node), до 8.40-cdi394n (HX7520 Appliance), до 8.40-cdi394n (HX7521 Certified Node), до 2.50 PSI346l (HX7820 Appliance), до 2.50 PSI346l (HX7821 Certified Node), до 3.60 TEI386M (MX Edge Appliance - MX1020), до 1.80 AFBT20N (MX3330-F All-flash Appliance), до 1.80 AFBT20N (MX3330-H Hybrid Appliance), до 1.80 AFBT20N (MX3331-F All-flash Certified node), до 1.80 AFBT20N (MX3331-H Hybrid Certified node), до 1.80 AFBT20N (MX3530 F All flash Appliance), до 1.80 AFBT20N (MX3530-H Hybrid Appliance), до 1.80 AFBT20N (MX3531 H Hybrid Certified node), до 1.80 AFBT20N (MX3531-F All-flash Certified node), до 3.60 TEI386M (ThinkAgile MX1021 on SE350), до 5.20 TEI3C8M (VX 1SE Certified Node), до 5.20 TEI3C8M (VX 2U4N Certified Node), до 2.50 PSI346l (VX 4U Certified Node), до 5.20 TEI3C8M (VX1320), до 8.40-cdi394n (VX2320), до 1.80 AFBT20N (VX2330 Appliance), до 8.40-cdi394n (VX3320), до 1.80 AFBT20N (VX3330 Appliance), до 8.40-cdi394n (VX3520-G), до 1.80 AFBT20N (VX3530-G Appliance), до 5.20 TEI3C8M (VX3720), до 8.40-cdi394n (VX5520), до 1.80 AFBT20N (VX5530 Appliance), до 8.40-cdi394n (VX7320 N), до 1.80 AFBT20N (VX7330 Appliance), до 8.40-cdi394n (VX7520), до 8.40-cdi394n (VX7520 N), до 1.80 AFBT20N (VX7530 Appliance), до 1.80 AFBT20N (VX7531 Certified Node), до 2.50 PSI346l (VX7820), до 1.10 USX304W (SE450), до 8.40-cdi394n (P920 Rack Workstation), до 5.20 TEI3C8M (SD530), до 2.00 TGBT36O (SD630 V2 (ThinkSystem)), до 5.20 TEI3C8M (SD650 DWC Dual Node Tray), до 2.00 TGBT36O (SD650 v2), до 2.00 TGBT36O (SD650-N V2), до 3.60 TEI386M (SE350), до 5.20 TEI3C8M (SN550), до 2.00 TGBT36O (SN550 V2), до 5.20 TEI3C8M (SN850), до 5.20 TEI3C8M (SR150), до 5.20 TEI3C8M (SR158), до 5.20 TEI3C8M (SR250), до 1.96 TGBT34X (SR250 V2), до 5.20 TEI3C8M (SR258), до 1.96 TGBT34X (SR258 V2), до 8.40-cdi394n (SR530), до 8.40-cdi394n (SR550), до 8.40-cdi394n (SR570), до 8.40-cdi394n (SR590), до 8.40-cdi394n (SR630), до 1.80 AFBT20N (SR630 V2), до 4.10 D8BT38L (SR645), до 8.40-cdi394n (SR650), до 1.80 AFBT20N (SR650 V2), до 4.10 D8BT38L (SR665), до 3.60 TEI386M (SR670), до 2.00 TGBT36O (SR670 V2), до 5.20 TEI3C8M (SR850), до 5.20 TEI3C8M (SR850 V2), до 3.60 TEI386M (SR850P), до 5.20 TEI3C8M (SR860), до 2.00 TGBT36O (SR860 V2), до 2.50 PSI346l (SR950), до 5.20 TEI3C8M (ST250), до 1.96 TGBT34X (ST250 V2), до 5.20 (ST258), до 1.96 TGBT34X (ST258 V2), до 8.40-cdi394n (ST550), до 2.00 TGBT36O (ST650 V2), до 2.00 TGBT36O (ST658 V2)

Product types

Firmware

Mitigations

Использование рекомендаций: https://support.lenovo.com/us/en/product_security/LEN-87734

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Lenovo Group Limited",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 1.80 AFBT20N (VX3331 Certified Node), \u0434\u043e 5.20 TEI3C8M (HX Enclosure Certified Node), \u0434\u043e 3.60 TEI386M (HX1021 Edge Certified Node 3yr), \u0434\u043e 8.40-cdi394n (HX1320 Appliance), \u0434\u043e 8.40-cdi394n (HX1321 Certified Node), \u0434\u043e 8.40-cdi394n (HX1520-R Appliance), \u0434\u043e 8.40-cdi394n (HX1521-R Certified Node), \u0434\u043e 8.40-cdi394n (HX2320-E Appliance), \u0434\u043e 8.40-cdi394n (HX2321 Certified Node), \u0434\u043e 5.20 TEI3C8M (HX2720-E Appliance), \u0434\u043e 8.40-cdi394n (HX3320 Appliance), \u0434\u043e 8.40-cdi394n (HX3321 Certified Node), \u0434\u043e 4.10 D8BT38L (HX3375 Appliance), \u0434\u043e 4.10 D8BT38L (HX3376 Certified Node), \u0434\u043e 8.40-cdi394n (HX3520-G Appliance), \u0434\u043e 8.40-cdi394n (HX3521-G Certified Node), \u0434\u043e 5.20 TEI3C8M (HX3720 Appliance), \u0434\u043e 5.20 TEI3C8M (HX3721 Certified Node), \u0434\u043e 8.40-cdi394n (HX5520 Appliance), \u0434\u043e 8.40-cdi394n (HX5520-C Appliance), \u0434\u043e 8.40-cdi394n (HX5521 Certified Node), \u0434\u043e 8.40-cdi394n (HX5521-C Certified Node), \u0434\u043e 8.40-cdi394n (HX7520 Appliance), \u0434\u043e 8.40-cdi394n (HX7521 Certified Node), \u0434\u043e 2.50 PSI346l (HX7820 Appliance), \u0434\u043e 2.50 PSI346l (HX7821 Certified Node), \u0434\u043e 3.60 TEI386M (MX Edge Appliance - MX1020), \u0434\u043e 1.80 AFBT20N (MX3330-F All-flash Appliance), \u0434\u043e 1.80 AFBT20N (MX3330-H Hybrid Appliance), \u0434\u043e 1.80 AFBT20N (MX3331-F All-flash Certified node), \u0434\u043e 1.80 AFBT20N (MX3331-H Hybrid Certified node), \u0434\u043e 1.80 AFBT20N (MX3530 F All flash Appliance), \u0434\u043e 1.80 AFBT20N (MX3530-H Hybrid Appliance), \u0434\u043e 1.80 AFBT20N (MX3531 H Hybrid Certified node), \u0434\u043e 1.80 AFBT20N (MX3531-F All-flash Certified node), \u0434\u043e 3.60 TEI386M (ThinkAgile MX1021 on SE350), \u0434\u043e 5.20 TEI3C8M (VX 1SE Certified Node), \u0434\u043e 5.20 TEI3C8M (VX 2U4N Certified Node), \u0434\u043e 2.50 PSI346l (VX 4U Certified Node), \u0434\u043e 5.20 TEI3C8M (VX1320), \u0434\u043e 8.40-cdi394n (VX2320), \u0434\u043e 1.80 AFBT20N (VX2330 Appliance), \u0434\u043e 8.40-cdi394n (VX3320), \u0434\u043e 1.80 AFBT20N (VX3330 Appliance), \u0434\u043e 8.40-cdi394n (VX3520-G), \u0434\u043e 1.80 AFBT20N (VX3530-G Appliance), \u0434\u043e 5.20 TEI3C8M (VX3720), \u0434\u043e 8.40-cdi394n (VX5520), \u0434\u043e 1.80 AFBT20N (VX5530 Appliance), \u0434\u043e 8.40-cdi394n (VX7320 N), \u0434\u043e 1.80 AFBT20N (VX7330 Appliance), \u0434\u043e 8.40-cdi394n (VX7520), \u0434\u043e 8.40-cdi394n (VX7520 N), \u0434\u043e 1.80 AFBT20N (VX7530 Appliance), \u0434\u043e 1.80 AFBT20N (VX7531 Certified Node), \u0434\u043e 2.50 PSI346l (VX7820), \u0434\u043e 1.10 USX304W (SE450), \u0434\u043e 8.40-cdi394n (P920 Rack Workstation), \u0434\u043e 5.20 TEI3C8M (SD530), \u0434\u043e 2.00 TGBT36O (SD630 V2 (ThinkSystem)), \u0434\u043e 5.20 TEI3C8M (SD650 DWC Dual Node Tray), \u0434\u043e 2.00 TGBT36O (SD650 v2), \u0434\u043e 2.00 TGBT36O (SD650-N V2), \u0434\u043e 3.60 TEI386M (SE350), \u0434\u043e 5.20 TEI3C8M (SN550), \u0434\u043e 2.00 TGBT36O (SN550 V2), \u0434\u043e 5.20 TEI3C8M (SN850), \u0434\u043e 5.20 TEI3C8M (SR150), \u0434\u043e 5.20 TEI3C8M (SR158), \u0434\u043e 5.20 TEI3C8M (SR250), \u0434\u043e 1.96 TGBT34X (SR250 V2), \u0434\u043e 5.20 TEI3C8M (SR258), \u0434\u043e 1.96 TGBT34X (SR258 V2), \u0434\u043e 8.40-cdi394n (SR530), \u0434\u043e 8.40-cdi394n (SR550), \u0434\u043e 8.40-cdi394n (SR570), \u0434\u043e 8.40-cdi394n (SR590), \u0434\u043e 8.40-cdi394n (SR630), \u0434\u043e 1.80 AFBT20N (SR630 V2), \u0434\u043e 4.10 D8BT38L (SR645), \u0434\u043e 8.40-cdi394n (SR650), \u0434\u043e 1.80 AFBT20N (SR650 V2), \u0434\u043e 4.10 D8BT38L (SR665), \u0434\u043e 3.60 TEI386M (SR670), \u0434\u043e 2.00 TGBT36O (SR670 V2), \u0434\u043e 5.20 TEI3C8M (SR850), \u0434\u043e 5.20 TEI3C8M (SR850 V2), \u0434\u043e 3.60 TEI386M (SR850P), \u0434\u043e 5.20 TEI3C8M (SR860), \u0434\u043e 2.00 TGBT36O (SR860 V2), \u0434\u043e 2.50 PSI346l (SR950), \u0434\u043e 5.20 TEI3C8M (ST250), \u0434\u043e 1.96 TGBT34X (ST250 V2), \u0434\u043e 5.20 (ST258), \u0434\u043e 1.96 TGBT34X (ST258 V2), \u0434\u043e 8.40-cdi394n (ST550), \u0434\u043e 2.00 TGBT36O (ST650 V2), \u0434\u043e 2.00 TGBT36O (ST658 V2)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://support.lenovo.com/us/en/product_security/LEN-87734",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "13.07.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "18.07.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "18.07.2022",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-04455",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-34884, LEN-87734",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "VX3331 Certified Node, HX Enclosure Certified Node, HX1021 Edge Certified Node 3yr, HX1320 Appliance, HX1321 Certified Node, HX1520-R Appliance, HX1521-R Certified Node, HX2320-E Appliance, HX2321 Certified Node, HX2720-E Appliance, HX3320 Appliance, HX3321 Certified Node, HX3375 Appliance, HX3376 Certified Node, HX3520-G Appliance, HX3521-G Certified Node, HX3720 Appliance, HX3721 Certified Node, HX5520 Appliance, HX5520-C Appliance, HX5521 Certified Node, HX5521-C Certified Node, HX7520 Appliance, HX7521 Certified Node, HX7820 Appliance, HX7821 Certified Node, MX Edge Appliance - MX1020, MX3330-F All-flash Appliance, MX3330-H Hybrid Appliance, MX3331-F All-flash Certified node, MX3331-H Hybrid Certified node, MX3530 F All flash Appliance, MX3530-H Hybrid Appliance, MX3531 H Hybrid Certified node, MX3531-F All-flash Certified node, ThinkAgile MX1021 on SE350, VX 1SE Certified Node, VX 2U4N Certified Node, VX 4U Certified Node, VX1320, VX2320, VX2330 Appliance, VX3320, VX3330 Appliance, VX3520-G, VX3530-G Appliance, VX3720, VX5520, VX5530 Appliance, VX7320 N, VX7330 Appliance, VX7520, VX7520 N, VX7530 Appliance, VX7531 Certified Node, VX7820, SE450, P920 Rack Workstation, SD530, SD630 V2 (ThinkSystem), SD650 DWC Dual Node Tray, SD650 v2, SD650-N V2, SE350, SN550, SN550 V2, SN850, SR150, SR158, SR250, SR250 V2, SR258, SR258 V2, SR530, SR550, SR570, SR590, SR630, SR630 V2, SR645, SR650, SR650 V2, SR665, SR670, SR670 V2, SR850, SR850 V2, SR850P, SR860, SR860 V2, SR950, ST250, ST250 V2, ST258, ST258 V2, ST550, ST650 V2, ST658 V2",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b Remote Presence \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0441\u0442\u043e\u0435\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Lenovo ThinkSystem, \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439 Lenovo ThinkStation, \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 Lenovo ThinkEdge, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Lenovo ThinkAgile, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0412\u044b\u0445\u043e\u0434 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 (CWE-119)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u044b Remote Presence \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0441\u0442\u043e\u0435\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Lenovo ThinkSystem, \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439 Lenovo ThinkStation, \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 Lenovo ThinkEdge, \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Lenovo ThinkAgile \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0437\u0430 \u0433\u0440\u0430\u043d\u0438\u0446\u044b \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.lenovo.com/us/en/product_security/LEN-87734",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-119",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CVE-2022-34884 (GCVE-0-2022-34884)

Vulnerability from cvelistv5 – Published: 2023-01-30 21:32 – Updated: 2025-03-27 15:19

Summary

A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of service.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-27 15:18 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

lenovo mitre root

References

1 reference

URL	Tags
https://support.lenovo.com/us/en/product_security…

Impacted products

1 product

Vendor	Product	Version
Lenovo	Lenovo XClarity Controller	Affected: various

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:22:10.816Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/LEN-87734"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-34884",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-27T15:18:51.648042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T15:19:13.850Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Lenovo XClarity Controller",
          "vendor": "Lenovo",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of service."
            }
          ],
          "value": "A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121: Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-30T21:32:54.220Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "url": "https://support.lenovo.com/us/en/product_security/LEN-87734"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to the Lenovo XClarity Controller (XCC) version (or higher) as recommended in the Product Impact section in LEN-87734."
            }
          ],
          "value": "Update to the Lenovo XClarity Controller (XCC) version (or higher) as recommended in the Product Impact section in LEN-87734."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2022-34884",
    "datePublished": "2023-01-30T21:32:54.220Z",
    "dateReserved": "2022-06-30T19:42:17.790Z",
    "dateUpdated": "2025-03-27T15:19:13.850Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.