Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-10253

Summary
Assigner-lenovo
Assigner Org ID-da227ddf-6e25-4b41-b023-0f976dcaca4b
Published At-14 Jan, 2025 | 21:17
Updated At-15 Jan, 2025 | 15:30
Rejected At-
Credits

A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:lenovo
Assigner Org ID:da227ddf-6e25-4b41-b023-0f976dcaca4b
Published At:14 Jan, 2025 | 21:17
Updated At:15 Jan, 2025 | 15:30
Rejected At:
▼CVE Numbering Authority (CNA)

A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.

Affected Products
Vendor
Lenovo Group LimitedLenovo
Product
PC Manager
Default Status
unaffected
Versions
Affected
  • From 0 before 5.1.90.12092 (custom)
Vendor
Lenovo Group LimitedLenovo
Product
Browser
Default Status
unaffected
Versions
Affected
  • From 0 before 9.0.5.12181 (custom)
Vendor
Lenovo Group LimitedLenovo
Product
App Store
Default Status
unaffected
Versions
Affected
  • From 0 before 9.0.20 (custom)
Problem Types
TypeCWE IDDescription
CWECWE-122CWE-122: Heap-based Buffer Overflow
Type: CWE
CWE ID: CWE-122
Description: CWE-122: Heap-based Buffer Overflow
Metrics
VersionBase scoreBase severityVector
3.14.7MEDIUM
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 4.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Update PC Manager to version 5.1.90.12092 or later.

Update Lenovo Browser to version 9.0.5.12181 or later.

Update Lenovo App Store to version 9.0.20 or later.

Configurations
Workarounds
Exploits
Credits
finder
Lenovo thanks Gareth Evans of Kryc for reporting this issue.
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://iknow.lenovo.com.cn/detail/425367
N/A
Hyperlink: https://iknow.lenovo.com.cn/detail/425367
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:psirt@lenovo.com
Published At:14 Jan, 2025 | 22:15
Updated At:14 Jan, 2025 | 22:15

A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.14.7MEDIUM
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Type: Primary
Version: 3.1
Base score: 4.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-122Secondarypsirt@lenovo.com
CWE ID: CWE-122
Type: Secondary
Source: psirt@lenovo.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://iknow.lenovo.com.cn/detail/425367psirt@lenovo.com
N/A
Hyperlink: https://iknow.lenovo.com.cn/detail/425367
Source: psirt@lenovo.com
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

5Records found
CVE-2024-10254
Matching Score-10
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-10
Assigner-Lenovo Group Ltd.
CVSS Score-4.7||MEDIUM
EPSS-0.02% / 2.44%
||
7 Day CHG~0.00%
Published-14 Jan, 2025 | 21:18
Updated-15 Jan, 2025 | 15:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a local attacker to cause a system crash.

Action-Not Available
Vendor-Lenovo Group Limited
Product-PC ManagerBrowserApp Store
CWE ID-CWE-122
Heap-based Buffer Overflow
CVE-2025-4657
Matching Score-6
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-6
Assigner-Lenovo Group Ltd.
CVSS Score-8.4||HIGH
EPSS-0.02% / 3.41%
||
7 Day CHG~0.00%
Published-17 Jul, 2025 | 19:22
Updated-17 Jul, 2025 | 21:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Lenovo App Store could allow a local attacker with elevated privileges to execute arbitrary code.

Action-Not Available
Vendor-Lenovo Group Limited
Product-App StorePC ManagerBrowser
CWE ID-CWE-122
Heap-based Buffer Overflow
CVE-2022-1890
Matching Score-6
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-6
Assigner-Lenovo Group Ltd.
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 9.58%
||
7 Day CHG~0.00%
Published-23 Jan, 2023 | 15:18
Updated-01 Apr, 2025 | 19:51
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

Action-Not Available
Vendor-Lenovo Group Limited
Product-thinkbook_15-imlthinkbook_14-iml_firmwareyoga_c640-13iml_firmwarethinkbook_15-iml_firmwarethinkbook_14-iil_firmwarethinkbook_14-imlthinkbook_15-iilyoga_c640-13imlyoga_c640-13iml_lte_firmwarethinkbook_14-iilthinkbook_15-iil_firmwareyoga_c640-13iml_lteBIOS
CWE ID-CWE-122
Heap-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2022-1891
Matching Score-6
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-6
Assigner-Lenovo Group Ltd.
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 9.58%
||
7 Day CHG~0.00%
Published-23 Jan, 2023 | 15:25
Updated-03 Apr, 2025 | 16:54
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

Action-Not Available
Vendor-Lenovo Group Limited
Product-thinkbook_15-imlthinkbook_14-iml_firmwareyoga_c640-13iml_firmwarethinkbook_15-iml_firmwarethinkbook_14-iil_firmwarethinkbook_14-imlthinkbook_15-iilyoga_c640-13imlyoga_c640-13iml_lte_firmwarethinkbook_14-iilthinkbook_15-iil_firmwareyoga_c640-13iml_lteBIOS
CWE ID-CWE-122
Heap-based Buffer Overflow
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2022-1892
Matching Score-6
Assigner-Lenovo Group Ltd.
ShareView Details
Matching Score-6
Assigner-Lenovo Group Ltd.
CVSS Score-6.7||MEDIUM
EPSS-0.04% / 9.58%
||
7 Day CHG~0.00%
Published-23 Jan, 2023 | 15:31
Updated-02 Apr, 2025 | 14:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.

Action-Not Available
Vendor-Lenovo Group Limited
Product-yoga_s730-13imlideapad_3-17ada05_firmwareideapad_s940-14iilthinkbook_14p_g2_ach500w_gen_3ideapad_3-14ada05s145-15api_firmwareideapad_5_15aba7v14_g2-alcyoga_c640-13iml_firmwareideapad_slim_1-11ast-05_firmwareyoga_c940-15irh_firmwarev14_g2-alc_firmwareideapad_5_15aba7_firmware100w_gen_3_firmwareideapad_flex_5_16alc7_firmware14w_gen_2v130-15ikbflex_5-15iil05s145-14ast_firmware300e_2nd_gen_firmwareyoga_s730-13iml_firmwarev14-ada_firmwareideapad_1-14ada05yoga_c940-15irhthinkbook_13s_g2_are_firmwarethinkbook_14s-iml_firmware13w_yoga_firmwareideapad_1-14igl05thinkbook_16p_g2_achflex_5-15iil05_firmwareyoga_c640-13iml_lte_firmwareflex_5-15itl05_firmwareideapad_3-17alc6legion_s7-15arh5s540-13api_firmwarev130-15ikb_firmwares145-15ast_firmwarethinkbook_14-iil_firmwareideapad_3-15alc6ideapad_3-15ada05ideapad_slim_1-14ast-05_firmwareflex_5-15alc05ideapad_3-15ada6100e_2nd_genthinkbook_14s_g2_itl300w_gen_3ideapad_3-17ada6_firmware100e_2nd_gen_firmwareideapad_5-15alc05ideapad_3-17ada05flex_5-14are05s145-15astthinkbook_14-iil300e_2nd_genflex_5-14alc05yoga_c640-13iml_ltelegion_s7-15ach6_firmware730s-13iml_firmwareyoga_slim_7_pro-14ach5_firmwarethinkbook_13s_g3_acn_firmwareyoga_slim_7_pro-14ach5_ov15_g2-alc_firmwarelegion_s7-15arh5_firmwares145-15apiyoga_s940-14iilideapad_slim_1-14ast-05yoga_slim_7_pro-14ach5ideapad_3-14alc6_firmwarethinkbook_14s-imllegion_s7-15imh5thinkbook_14-iml_firmwarethinkbook_15-iml_firmware300w_gen_3_firmwarelegion_s7-15imh5_firmwarethinkbook_13s_g2_itllegion_s7-15ach6500w_gen_3_firmwarethinkbook_13s_g2_areideapad_3-14ada6ideapad_3-15ada6_firmware730s-13imlthinkbook_15-iil_firmwareideapad_3-17ada6ideapad_slim_1-11ast-05v15-ada_firmwareideapad_1-14igl05_firmwarethinkbook_16p_g2_ach_firmwareyoga_slim_7_pro-14arh5ideapad_1-11ada05_firmwarethinkbook_13s-iml_firmwareflex_5-15itl05thinkbook_13s-imlv15-adaideapad_flex_5_16alc714w_gen_2_firmwareideapad_flex_5_14alc7ideapad_1-11ada05ideapad_5-15alc05_firmwareflex_5-14iil05yoga_s940-14iil_firmwares145-14api_firmwarethinkbook_15-imlyoga_slim_7_pro-14ach5_o_firmwareyoga_slim_7_pro-14arh5_firmware100w_gen_3ideapad_3-14alc6thinkbook_14s_g2_itl_firmwarethinkbook_15-iilv15_g2-alcflex_3-11ada05s145-14astthinkbook_13s_g3_acnflex_5-14alc05_firmwareflex_3-11ada05_firmwarethinkbook_14p_g2_ach_firmwareideapad_1-14ada05_firmwareideapad_3-14ada05_firmwareflex_5-15alc05_firmwareflex_5-14itl05_firmwarev14-adaideapad_3-15alc6_firmwareideapad_3-14ada6_firmwareflex_5-14iil05_firmwareideapad_1-11igl05ideapad_3-15ada05_firmwareideapad_3-17alc6_firmwarethinkbook_13s_g2_itl_firmwareyoga_9-15imh5flex_5-14itl05ideapad_1-11igl05_firmwares540-13apiideapad_flex_5_14alc7_firmwarethinkbook_14-imlideapad_s940-14iil_firmwareflex_5-14are05_firmwareyoga_9-15imh5_firmwares145-14api13w_yogayoga_c640-13imlBIOS
CWE ID-CWE-122
Heap-based Buffer Overflow
CWE ID-CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Details not found