CVE-2024-11679 | THREATINT

Description

An input validation weakness was reported in the TpmSetup module for some legacy System x server products that could allow a local attacker with elevated privileges to read the contents of memory.

PUBLISHED Reserved 2024-11-25 | Published 2025-04-11 | Updated 2025-04-11 | Assigner lenovo

MEDIUM: 6.7CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

MEDIUM: 4.4CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-125 Out-of-bounds Read

Product status

Default status

unaffected

Any version before 4.40

affected

Default status

unaffected

Any version before 4.20

affected

Credits

Lenovo thanks Eason for reporting this issue. finder

References

support.lenovo.com/us/en/product_security/LEN-193044

cve.org (CVE-2024-11679)

nvd.nist.gov (CVE-2024-11679)

Download JSON