Executive brief
A security vulnerability in the Lenovo Transition application, pre-installed on Yoga, Flex, and Miix laptops, could allow a user with limited access to gain full control over the device. This application is designed to manage screen orientation and keyboard behavior when the laptop is folded into different modes. If exploited, an attacker who already has basic access to the computer could run malicious software with administrative privileges, potentially leading to data theft or complete system compromise.
Technical details
A privilege escalation vulnerability exists in the Lenovo Transition application due to improper access controls (CWE-284). The application, which manages hardware state transitions on Lenovo convertible laptops, fails to properly restrict permissions, allowing a local authenticated user with low privileges to execute arbitrary code with SYSTEM-level authority. The attack vector is local, requiring the attacker to have existing access to the target machine. Successful exploitation results in a complete compromise of confidentiality, integrity, and availability. Lenovo has released security updates to address this issue in the affected software.
Affected products
- Lenovo Transition All versions prior to fix
Timeline
- 2017-01-26: advisory: Initial NVD publication date
- 2017-01-26: disclosed: Vendor advisory published by Lenovo