CVE-2023-4029

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-17 · updated 2026-06-17
Weakness: CWE-120

Description

A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

Lenovo K14 Type 21Cu Firmware: before 1.12 — fixed in 1.12
Lenovo K14 Type 21Cv Firmware: before 1.12 — fixed in 1.12
Lenovo Thinkpad E14 Gen 3 Firmware: before 1.15 — fixed in 1.15
Lenovo Thinkpad E15 Gen 3 Firmware: before 1.15 — fixed in 1.15
Lenovo Thinkpad L13 Gen 2 Firmware: before 1.30 — fixed in 1.30
Lenovo Thinkpad L13 Gen 3 Firmware: before 1.19 — fixed in 1.19
Lenovo Thinkpad L13 Gen 4 Firmware: before 1.10 — fixed in 1.10
Lenovo Thinkpad L13 Yoga Gen 2 Firmware: before 1.30 — fixed in 1.30
Lenovo Thinkpad L13 Yoga Gen 3 Firmware: before 1.19 — fixed in 1.19
Lenovo Thinkpad L13 Yoga Gen 4 Firmware: before 1.10 — fixed in 1.10
Lenovo Thinkpad L14 Gen 2 Firmware: before 1.28 — fixed in 1.28
Lenovo Thinkpad L14 Gen 3 Firmware: before 1.23 — fixed in 1.23
Lenovo Thinkpad L14 Gen 4 Firmware: before 1.06 — fixed in 1.06
Lenovo Thinkpad L15 Gen 2 Firmware: before 1.28 — fixed in 1.28
Lenovo Thinkpad L15 Gen 3 Firmware: before 1.23 — fixed in 1.23
Lenovo Thinkpad L15 Gen 4 Firmware: before 1.06 — fixed in 1.06
Lenovo Thinkpad P14S Gen 2 Firmware: before 1.34 — fixed in 1.34
Lenovo Thinkpad S2 Gen 6 Firmware: before 1.30 — fixed in 1.30
Lenovo Thinkpad S2 Gen 7 Firmware: before 1.19 — fixed in 1.19
Lenovo Thinkpad S2 Gen 8 Firmware: before 1.10 — fixed in 1.10
Lenovo Thinkpad S2 Yoga Gen 6 Firmware: before 1.30 — fixed in 1.30
Lenovo Thinkpad S2 Yoga Gen 7 Firmware: before 1.19 — fixed in 1.19
Lenovo Thinkpad S2 Yoga Gen 8 Firmware: before 1.10 — fixed in 1.10
Lenovo Thinkpad T14 Gen 2 Firmware: before 1.34 — fixed in 1.34
Lenovo Thinkpad T14S Gen 2 Firmware: before 1.37 — fixed in 1.37
Lenovo Thinkpad X13 Gen 2 Firmware: before 1.37 — fixed in 1.37

How to fix

Upgrade to a fixed version: Lenovo K14 Type 21Cu Firmware 1.12; Lenovo K14 Type 21Cv Firmware 1.12; Lenovo Thinkpad E14 Gen 3 Firmware 1.15; Lenovo Thinkpad E15 Gen 3 Firmware 1.15; Lenovo Thinkpad L13 Gen 2 Firmware 1.30; Lenovo Thinkpad L13 Gen 3 Firmware 1.19; Lenovo Thinkpad L13 Gen 4 Firmware 1.10; Lenovo Thinkpad L13 Yoga Gen 2 Firmware 1.30; Lenovo Thinkpad L13 Yoga Gen 3 Firmware 1.19; Lenovo Thinkpad L13 Yoga Gen 4 Firmware 1.10; Lenovo Thinkpad L14 Gen 2 Firmware 1.28; Lenovo Thinkpad L14 Gen 3 Firmware 1.23. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-4029 or the next vulnerability affects your stack