Lenovo Rescue and Recovery monitors system changes and enables users to quickly restore their systems in the event of failure. One component of the Rescue and Recovery system is a file system filter driver which monitors new file writes/reads.
There is a heap overflow in the Lenovo Rescue and Recovery file system filter kernel driver which could allow an attacker to overwrite kernel memory leading to elevation of privilege.
Vulnerable Systems:
* Lenovo Rescue and Recovery verison 4.20
The tvtumon.sys driver serves as a file system filter driver which monitors for file creation or changes. Recent lookups are cached within a kernel lookaside list. If an overly long filename is passed through the filesystem, then a buffer within the lookaside list will overflow, leading to kernel memory corruption.
A low privileged user can trigger this corruption from user mode and potentially escalate privileges to act as part of the kernel. In the (unlikely) event that a web browser plugin allows opening of long filenames, there is a chance the corruption could be triggered through a web page.
Fix Information:
Lenovo has issued a patch and advisory:
