Lenovo Multiple Products DLL Hijacking Privilege Escalation Vulnerabilities (CVE-2024-4089 etc.) Security Advisory

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Advisory: - Advisory ID: LEN-174329 - Affected Products: Desktops, ThinkCentre, Laptops, ThinkPad, ThinkStation, Servers - Potential Impact: Privilege Escalation - Severity: High - Scope: Specific Lenovo products - CVE IDs: CVE-2024-4089, CVE-2024-4130, CVE-2024-4131, CVE-2024-9046, CVE-2024-33578, CVE-2024-33579, CVE-2024-33580, CVE-2024-33581, CVE-2024-33582 2. Symptoms: - A DLL hijacking vulnerability reported in Lenovo Super File, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo App Store, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo Emulator, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo Lock Screen, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo stARstudio, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo LeYun, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo Baiying, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo Personal Cloud, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo PC Manager AI Smart Scenarios, which may allow a local attacker to execute code with elevated privileges. - A DLL hijacking vulnerability reported in Lenovo Service Framework, which may allow a local attacker to execute code with elevated privileges. 3. Remediation: - Update Lenovo Super File to version 2.4 or later. - Update Lenovo App Store to version 9.0.18 or later. - Update Lenovo Emulator to version 9.1.6 or later. - Update Lenovo Lock Screen to version 9.0.18 or later. - Update stARstudio to version 2020.3.12.34806 or later. - Lenovo LeYun has reached EOS; upgrade to Lenovo Super File. - Update Lenovo Baiying to version 2.0 or later. - Update Lenovo Personal Cloud to version 2.3.0 or later. - Update Lenovo PC Manager AI Smart Scenarios to version 5.1.80.9023 or later. - Update Lenovo Service Framework to version 2.5.0.218 or later. 4. Acknowledgments: - Lenovo thanks ggid7788 for reporting these vulnerabilities. 5. Revision History: - Revision: 1 - Date: 2024-10-10 - Description: Initial version This information provides a detailed description of the vulnerability’s nature, scope, remediation steps, and revision history, helping users understand and address this security risk.

Goal Reached Thanks to every supporter — we hit 100%!

Lenovo Multiple Products DLL Hijacking Privilege Escalation Vulnerabilities (CVE-2024-4089 etc.) Security Advisory