CVE-2017-3753 : Chi tiết

CVE-2017-3753

6.8
/
Trung bình
0.04%V4
2017-08-10
00h00 +00:00
Code Injection
A03-Injection
Physical
2024-09-16
20h47 +00:00
CVE.org
NVD
Thông báo cho một CVE
Luôn được thông báo về mọi thay đổi đối với một CVE cụ thể.
Quản lý thông báo

Mô tả CVE

A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V.

Thông tin CVE

Điểm yếu liên quan

CWE-ID Tên điểm yếu Nguồn
CWE-94 Improper Control of Generation of Code
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Số liệu

Số liệu Điểm Mức độ nghiêm trọng CVSS Vector Nguồn
V3.0 6.8 MEDIUM CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base: Exploitabilty Metrics

The Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component.

Attack Vector

This metric reflects the context by which vulnerability exploitation is possible.

Physical

A vulnerability exploitable with Physical access requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief (e.g. evil maid attack [1]) or persistent. An example of such an attack is a cold boot attack which allows an attacker to access to disk encryption keys after gaining physical access to the system, or peripheral attacks such as Firewire/USB Direct Memory Access attacks.

Attack Complexity

This metric describes the conditions beyond the attacker's control that must exist in order to exploit the vulnerability.

Low

Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.

Privileges Required

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

None

The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.

User Interaction

This metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component.

None

The vulnerable system can be exploited without interaction from any user.

Base: Scope Metrics

An important property captured by CVSS v3.0 is the ability for a vulnerability in one software component to impact resources beyond its means, or privileges.

Scope

Formally, Scope refers to the collection of privileges defined by a computing authority (e.g. an application, an operating system, or a sandbox environment) when granting access to computing resources (e.g. files, CPU, memory, etc). These privileges are assigned based on some method of identification and authorization. In some cases, the authorization may be simple or loosely controlled based upon predefined rules or standards. For example, in the case of Ethernet traffic sent to a network switch, the switch accepts traffic that arrives on its ports and is an authority that controls the traffic flow to other switch ports.

Unchanged

An exploited vulnerability can only affect resources managed by the same authority. In this case the vulnerable component and the impacted component are the same.

Base: Impact Metrics

The Impact metrics refer to the properties of the impacted component.

Confidentiality Impact

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

High

There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server.

Integrity Impact

This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information.

High

There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.

Availability Impact

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability.

High

There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Temporal Metrics

The Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence that one has in the description of a vulnerability.

Environmental Metrics

 nvd@nist.gov
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS là mô hình tính điểm dự đoán khả năng một lỗ hổng bị khai thác.

Điểm EPSS

Mô hình EPSS tạo ra điểm xác suất từ 0 đến 1 (0 đến 100%). Điểm càng cao, xác suất một lỗ hổng bị khai thác càng lớn.

Phân vị EPSS

Phân vị được dùng để xếp hạng CVE theo điểm EPSS. Ví dụ, một CVE ở phân vị thứ 95 theo điểm EPSS có nhiều khả năng bị khai thác hơn 95% CVE khác. Do đó, phân vị được dùng để so sánh điểm EPSS của một CVE với các CVE khác.
EPSS First.org

Sản phẩm được đề cập

Cấu hình 0

Lenovo>>Ideacentre_300-20ish_firmware >> Version -

Lenovo>>Ideacentre_300-20ish >> Version -

Cấu hình 0

Lenovo>>Ideacentre_300s-11ish_firmware >> Version -

Lenovo>>Ideacentre_300s-11ish >> Version -

Cấu hình 0

Lenovo>>Ideacentre_510s-08ish_firmware >> Version -

Lenovo>>Ideacentre_510s-08ish >> Version -

Cấu hình 0

Lenovo>>Ideacentre_700_firmware >> Version -

Lenovo>>Ideacentre_700 >> Version -

Cấu hình 0

Lenovo>>63_firmware >> Version fckt78a

Lenovo>>63 >> Version -

Cấu hình 0

Lenovo>>H50-30g_firmware >> Version fckt78a

Lenovo>>H50-30g >> Version -

Cấu hình 0

Lenovo>>M4500_firmware >> Version fckt78a

Lenovo>>M4500 >> Version -

Cấu hình 0

Lenovo>>M4500_id_firmware >> Version fckt78a

Lenovo>>M4500_id >> Version -

Cấu hình 0

Lenovo>>M4550_id_firmware >> Version fckt78a

Lenovo>>M4550_id >> Version -

Cấu hình 0

Lenovo>>S500_firmware >> Version m0kkt24a

Lenovo>>S500 >> Version -

Cấu hình 0

Lenovo>>V320-15iap_firmware >> Version -

Lenovo>>V320-15iap >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e73_firmware >> Version fckt78a

Lenovo>>Thinkcentre_e73 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e73s_firmware >> Version fckt78a

Lenovo>>Thinkcentre_e73s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e74_firmware >> Version m05kt54a

Lenovo>>Thinkcentre_e74 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e74s_firmware >> Version m05kt54a

Lenovo>>Thinkcentre_e74s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e75_t\/s_firmware >> Version -

Lenovo>>Thinkcentre_e75_t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e79_firmware >> Version m0lkt12a

Lenovo>>Thinkcentre_e79 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e93_firmware >> Version fbktc5a

Lenovo>>Thinkcentre_e93 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m4500k_firmware >> Version fckt78a

Lenovo>>Thinkcentre_m4500k >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m4500q_firmware >> Version fhkt66a

Lenovo>>Thinkcentre_m4500q >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m4500t\/s_firmware >> Version fckt78a

Lenovo>>Thinkcentre_m4500t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m4600t\/s_firmware >> Version m05kt54a

Lenovo>>Thinkcentre_m4600t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m600_firmware >> Version m00kt44a

Lenovo>>Thinkcentre_m600 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m610_firmware >> Version -

Lenovo>>Thinkcentre_m610 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m6500t\/s_firmware >> Version fbktc5a

Lenovo>>Thinkcentre_m6500t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m6600_firmware >> Version fwkt39a

Lenovo>>Thinkcentre_m6600 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m6600q_firmware >> Version fwkt39a

Lenovo>>Thinkcentre_m6600q >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m6600t\/s_firmware >> Version fwkt39a

Lenovo>>Thinkcentre_m6600t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m700_firmware >> Version m05kt54a

Lenovo>>Thinkcentre_m700 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m710t\/s_firmware >> Version -

Lenovo>>Thinkcentre_m710t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m715q_firmware >> Version -

Lenovo>>Thinkcentre_m715q >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m72e_firmware >> Version f1kt71a

Lenovo>>Thinkcentre_m72e >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m73_firmware >> Version fckt78a

Lenovo>>Thinkcentre_m73 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m73p_firmware >> Version fbktc5a

Lenovo>>Thinkcentre_m73p >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m79_firmware >> Version m0lkt12a

Lenovo>>Thinkcentre_m79 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m800_firmware >> Version fwkt39a

Lenovo>>Thinkcentre_m800 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m83_firmware >> Version fbktcga

Lenovo>>Thinkcentre_m83 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m8500t\/s_firmware >> Version fbktc5a

Lenovo>>Thinkcentre_m8500t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m8600t\/s_firmware >> Version fwkt39a

Lenovo>>Thinkcentre_m8600t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m900_firmware >> Version fwkt39a

Lenovo>>Thinkcentre_m900 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m910t\/s_firmware >> Version -

Lenovo>>Thinkcentre_m910t\/s >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m910q_firmware >> Version -

Lenovo>>Thinkcentre_m910q >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m910x_firmware >> Version -

Lenovo>>Thinkcentre_m910x >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m92_firmware >> Version 9skt95a

Lenovo>>Thinkcentre_m92 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m92p_firmware >> Version 9skt95a

Lenovo>>Thinkcentre_m92p >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m93_firmware >> Version fbktc5a

Lenovo>>Thinkcentre_m93 >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m93p_firmware >> Version fbktc5a

Lenovo>>Thinkcentre_m93p >> Version -

Cấu hình 0

Lenovo>>Yangtian_afh110_firmware >> Version m05kt73a

Lenovo>>Yangtian_afh110 >> Version -

Cấu hình 0

Lenovo>>Yangtian_afh81_firmware >> Version fckt80a

Lenovo>>Yangtian_afh81 >> Version -

Cấu hình 0

Lenovo>>Yangtian_afq150_firmware >> Version fwkt57a

Lenovo>>Yangtian_afq150 >> Version -

Cấu hình 0

Lenovo>>Yangtian_mc_carrizo-l_firmware >> Version -

Lenovo>>Yangtian_mc_carrizo-l >> Version -

Cấu hình 0

Lenovo>>Yangtian_mc_godavari_firmware >> Version m0lkt13a

Lenovo>>Yangtian_mc_godavari >> Version -

Cấu hình 0

Lenovo>>Yangtian_mc_h110_firmware >> Version m05kt61a

Lenovo>>Yangtian_mc_h110 >> Version -

Cấu hình 0

Lenovo>>Yangtian_mc_h81_firmware >> Version fckt80a

Lenovo>>Yangtian_mc_h81 >> Version -

Cấu hình 0

Lenovo>>Yangtian_me\/we_h110_firmware >> Version m05kt61a

Lenovo>>Yangtian_mc_h110 >> Version -

Cấu hình 0

Lenovo>>Yangtian_mf\/wf_h81_firmware >> Version fckt80a

Lenovo>>Yangtian_mf\/wf_h81 >> Version -

Cấu hình 0

Lenovo>>Ideacentre_510s-23isu_firmware >> Version o2ekt24a

Lenovo>>Ideacentre_510s-23isu >> Version -

Cấu hình 0

Lenovo>>S200z_firmware >> Version m09kt33a

Lenovo>>S200z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e73z_\(aio\)_firmware >> Version fgkt49a

Lenovo>>Thinkcentre_e73z_\(aio\) >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e74z_firmware >> Version fvkt48a

Lenovo>>Thinkcentre_e74z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_e93z_\(aio\)_firmware >> Version ffkt43a

Lenovo>>Thinkcentre_e93z_\(aio\) >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_edge_62z_firmware >> Version f8kt40a

Lenovo>>Thinkcentre_edge_62z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m700z_firmware >> Version fvkt48a

Lenovo>>Thinkcentre_m700z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m7200z_firmware >> Version fgkt46a

Lenovo>>Thinkcentre_m7200z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m7250z_firmware >> Version fgkt46a

Lenovo>>Thinkcentre_m7250z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m7300z_firmware >> Version fvkt42a

Lenovo>>Thinkcentre_m7300z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m73z_\(aio\)_firmware >> Version fgkt46a

Lenovo>>Thinkcentre_m73z_\(aio\) >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m800z_firmware >> Version fvkt42a

Lenovo>>Thinkcentre_m800z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m810z_firmware >> Version -

Lenovo>>Thinkcentre_m810z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m8200z_firmware >> Version fgkt46a

Lenovo>>Thinkcentre_m8200z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m8250z_firmware >> Version fgkt46a

Lenovo>>Thinkcentre_m8250z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m8300z_firmware >> Version fvkt42a

Lenovo>>Thinkcentre_m8300z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m8350z_firmware >> Version fvkt42a

Lenovo>>Thinkcentre_m8350z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m83z_\(aio\)_firmware >> Version fvkt42a

Lenovo>>Thinkcentre_m83z_\(aio\) >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m900z_firmware >> Version fukt39a

Lenovo>>Thinkcentre_m900z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m9500z_firmware >> Version fukt44a

Lenovo>>Thinkcentre_m9500z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_m9550z_firmware >> Version fukt44a

Lenovo>>Thinkcentre_m9550z >> Version -

Cấu hình 0

Lenovo>>Thinkcentre_x1_aio_firmware >> Version m0hkt32a

Lenovo>>Thinkcentre_x1_aio >> Version -

Cấu hình 0

Lenovo>>Yangtian_s3040_firmware >> Version fgkt49a

Lenovo>>Yangtian_s3040 >> Version -

Cấu hình 0

Lenovo>>Yangtian_s800_firmware >> Version ffkt43a

Lenovo>>Yangtian_s3040 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_rd340_firmware >> Version -

Lenovo>>Thinkserver_rd340 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_rd440_firmware >> Version a0tsb5a

Lenovo>>Thinkserver_rd440 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_rd540_firmware >> Version a1tsb5a

Lenovo>>Thinkserver_rd540 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_rd640_firmware >> Version a1tsb5a

Lenovo>>Thinkserver_rd540 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_rq750_firmware >> Version 7.05

Lenovo>>Thinkserver_rq750 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_rs140_firmware >> Version fbkt91c

Lenovo>>Thinkserver_rs140 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_td340_firmware >> Version a3tsb5a

Lenovo>>Thinkserver_td340 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_ts140_firmware >> Version fbktc3a

Lenovo>>Thinkserver_ts140 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_ts150_firmware >> Version fbktc3a

Lenovo>>Thinkserver_ts150 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_ts240_firmware >> Version fbktc3a

Lenovo>>Thinkserver_ts240 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_ts250_firmware >> Version -

Lenovo>>Thinkserver_ts250 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_ts450_firmware >> Version -

Lenovo>>Thinkserver_ts450 >> Version -

Cấu hình 0

Lenovo>>Thinkserver_ts550_firmware >> Version -

Lenovo>>Thinkserver_ts550 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_c30_\(1136\)_firmware >> Version a1kt57a

Lenovo>>Thinkstation_c30_\(1136\) >> Version -

Cấu hình 0

Lenovo>>Thinkstation_d30_\(4353\)_firmware >> Version a3kt57a

Lenovo>>Thinkstation_d30_\(4353\) >> Version -

Cấu hình 0

Lenovo>>Thinkstation_e31_firmware >> Version 9skt97a

Lenovo>>Thinkstation_e31 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_e32_firmware >> Version fbktc6a

Lenovo>>Thinkstation_e32 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p300_firmware >> Version fbktc6a

Lenovo>>Thinkstation_p300 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p310_firmware >> Version fwkt57a

Lenovo>>Thinkstation_p310 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p320_firmware >> Version -

Lenovo>>Thinkstation_p320 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p410_firmware >> Version -

Lenovo>>Thinkstation_p410 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p500_firmware >> Version a4kt86a

Lenovo>>Thinkstation_p500 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p510_firmware >> Version -

Lenovo>>Thinkstation_p510 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p700_firmware >> Version a5kt86a

Lenovo>>Thinkstation_p700 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p710_firmware >> Version -

Lenovo>>Thinkstation_p710 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p900_firmware >> Version a6kt86a

Lenovo>>Thinkstation_p900 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_p910_firmware >> Version -

Lenovo>>Thinkstation_p910 >> Version -

Cấu hình 0

Lenovo>>Thinkstation_s30_\(4351\)_firmware >> Version a2kt54a

Lenovo>>Thinkstation_s30_\(4351\) >> Version -

Cấu hình 0

Lenovo>>Thinkstation_c30_\(1137\)_firmware >> Version a1kt57a

Lenovo>>Thinkstation_c30_\(1137\) >> Version -

Cấu hình 0

Lenovo>>Thinkstation_s30_\(4352\)_firmware >> Version a2kt54a

Lenovo>>Thinkstation_s30_\(4352\) >> Version -

Cấu hình 0

Lenovo>>Thinkstation_d30_\(4354\)_firmware >> Version a3kt57a

Lenovo>>Thinkstation_d30_\(4354\) >> Version -

Tài liệu tham khảo

Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.