CVE-2019-18619

Katalog CVE

CVSS 7.8 · High EPSS 0,51%

Kerentanan Release of Invalid Pointer or Reference pada synaptics vfs75xx firmware, lenovo thinkpad 25 firmware +42 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers.

Rincian

Terbit di NVD

22 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-763: Release of Invalid Pointer or Reference

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 42,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 128 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://www.synaptics.com/company/blog/ advisory vendor
• https://www.synaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdf advisory vendor
• https://www.syssec.wiwi.uni-due.de/en/research/research-projects/analysis-of-tee-software/ advisory vendor
• https://support.hp.com/hk-en/document/c06696568 patch · advisory pihak ketiga
• https://support.lenovo.com/us/en/product_security/LEN-31372 patch · advisory pihak ketiga