CVE-2024-26836 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix password opcode ordering for workstations The Lenovo workstations require the password opcode to be run before the attribute value is changed (if Admin password is enabled). Tested on some Thinkpads to confirm they are OK with this order too.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4
https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a
https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340
https://lore.kernel.org/linux-cve-announce/2024041714-CVE-2024-26836-19c3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2024-26836
https://www.cve.org/CVERecord?id=CVE-2024-26836

History

Thu, 10 Oct 2024 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 10 Oct 2024 11:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-04-17T10:10:03.539Z

Updated: 2024-11-05T09:16:40.655Z

Reserved: 2024-02-19T14:20:24.181Z

Link: CVE-2024-26836

Vulnrichment

Updated: 2024-08-02T00:14:13.702Z

NVD

Status : Awaiting Analysis

Published: 2024-04-17T10:15:09.713

Modified: 2024-10-10T12:15:03.120

Link: CVE-2024-26836

Redhat

Severity : Low

Publid Date: 2024-04-17T00:00:00Z

Links: CVE-2024-26836 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-26836", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.181Z", "datePublished": "2024-04-17T10:10:03.539Z", "dateUpdated": "2024-11-05T09:16:40.655Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:16:40.655Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: think-lmi: Fix password opcode ordering for workstations\n\nThe Lenovo workstations require the password opcode to be run before\nthe attribute value is changed (if Admin password is enabled).\n\nTested on some Thinkpads to confirm they are OK with this order too."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/platform/x86/think-lmi.c"], "versions": [{"version": "640a5fa50a42", "lessThan": "2deb10a99671", "status": "affected", "versionType": "git"}, {"version": "640a5fa50a42", "lessThan": "2bfbe1e0aed0", "status": "affected", "versionType": "git"}, {"version": "640a5fa50a42", "lessThan": "6f7d0f5fd8e4", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/platform/x86/think-lmi.c"], "versions": [{"version": "5.17", "status": "affected"}, {"version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.55", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.7", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a"}, {"url": "https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4"}, {"url": "https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340"}], "title": "platform/x86: think-lmi: Fix password opcode ordering for workstations", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26836", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-09T18:40:16.336902Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:49:05.605Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.702Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.702Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-26836", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-09T18:40:16.336902Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:24.260Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "platform/x86: think-lmi: Fix password opcode ordering for workstations", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "640a5fa50a42", "lessThan": "2deb10a99671", "versionType": "git"}, {"status": "affected", "version": "640a5fa50a42", "lessThan": "2bfbe1e0aed0", "versionType": "git"}, {"status": "affected", "version": "640a5fa50a42", "lessThan": "6f7d0f5fd8e4", "versionType": "git"}], "programFiles": ["drivers/platform/x86/think-lmi.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.17"}, {"status": "unaffected", "version": "0", "lessThan": "5.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.55", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.7", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/platform/x86/think-lmi.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a"}, {"url": "https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4"}, {"url": "https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/x86: think-lmi: Fix password opcode ordering for workstations\n\nThe Lenovo workstations require the password opcode to be run before\nthe attribute value is changed (if Admin password is enabled).\n\nTested on some Thinkpads to confirm they are OK with this order too."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-05T09:16:40.655Z"}}}, "cveMetadata": {"cveId": "CVE-2024-26836", "state": "PUBLISHED", "dateUpdated": "2024-11-05T09:16:40.655Z", "dateReserved": "2024-02-19T14:20:24.181Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-04-17T10:10:03.539Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}