CVE-2024-26836

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26836
In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix password opcode ordering for workstations The Lenovo workstations require the password opcode to be run before the attribute value is changed (if Admin password is enabled). Tested on some Thinkpads to confirm they are OK with this order too.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4 Patch
https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a Patch
https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340 Patch
https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4 Patch
https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
History

02 Apr 2025, 13:18

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4 - () https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4 - Patch
References () https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a - () https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a - Patch
References () https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340 - () https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340 - Patch
First Time Linux linux Kernel
Linux
CWE NVD-CWE-noinfo
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

21 Nov 2024, 09:03

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4 - () https://git.kernel.org/stable/c/2bfbe1e0aed00ba51d58573c79452fada3f62ed4 -
References () https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340 - () https://git.kernel.org/stable/c/6f7d0f5fd8e440c3446560100ac4ff9a55eec340 -

10 Oct 2024, 12:15

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: plataforma/x86: think-lmi: corrige el orden del código de operación de contraseña para las estaciones de trabajo Las estaciones de trabajo Lenovo requieren que se ejecute el código de operación de la contraseña antes de cambiar el valor del atributo (si la contraseña de administrador está habilitada). Probado en algunos Thinkpads para confirmar que también están de acuerdo con este pedido.
References
  • () https://git.kernel.org/stable/c/2deb10a99671afda30f834e95e5b992a805bba6a -

17 Apr 2024, 12:48

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-17 10:15

Updated : 2025-04-02 13:18

NVD link : CVE-2024-26836

Mitre link : CVE-2024-26836

CVE.ORG link : CVE-2024-26836

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo