NetSight
IP …
high7.8

CVE-2019-18619

Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to…

Impact

Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers.

Affected products

VendorProductAffected versions
SynapticsVfs75xx Firmware
Versions 5.2.225.26, 5.2.318.26, 5.2.524.26, 5.2.3530.26, 5.3.3539.26, 5.5.3.1116
LenovoThinkpad 25 Firmware
before 5.2.3540.26
LenovoThankpad A475 Firmware
before 5.02.3539.0026
LenovoThankpad A485 Firmware
before 5.03.3542.0026
LenovoThinkpad E480 Firmware
before 5.2.321.26
LenovoThinkpad E580 Firmware
before 5.2.321.26
LenovoThinkpad E485 Firmware
before 5.2.321.26
LenovoThinkpad E585 Firmware
before 5.2.321.26
LenovoThinkpad E490s Firmware
before 5.2.321.26
LenovoThinkpad S3 Firmware
before 5.2.321.26
LenovoThinkpad E490 Firmware
before 5.2.321.26
LenovoThinkpad E590 Firmware
before 5.2.321.26

Weakness classification

CWE-763

References