Executive brief
A security vulnerability exists in the software drivers for Lenovo Edge and Slim USB keyboards. This flaw could allow a person with physical or local access to a computer to run unauthorized programs with high-level system privileges. This could lead to a full takeover of the affected machine, potentially compromising all data and operations on that device.
Technical details
The vulnerability is a classic unquoted service path (CWE-428) within the Lenovo Edge and Slim USB Keyboard Drivers. When a service path contains spaces and is not enclosed in quotation marks, the Windows Service Control Manager may attempt to execute files in the parent directories if they match the first part of the path (e.g., 'C:\Program.exe' instead of 'C:\Program Files\Lenovo\...'). A local attacker with basic user privileges can place a malicious executable in the search path to intercept the service launch. Successful exploitation allows the attacker to execute arbitrary code with SYSTEM privileges. The issue is resolved in driver version 1.21.
Affected products
- Lenovo Edge Keyboard Driver Earlier than 1.21
- Lenovo Slim USB Keyboard Driver Earlier than 1.21
Timeline
- 2017-01-26: advisory: NVD published date
- 2017-01-26: disclosed: Lenovo security advisory published