Lenovo has fixed a number of major BIOS flaws which allow threat actors to potentially launch all kinds of devastating cyberattacks across a wide range of its products, from desktop PCs (opens in new tab), to laptops.
In a security advisory published earlier this week, the company said that hundreds of its devices, from Desktop, All in One, IdeaCentre, Legion, ThinkCentre, ThinkPad, ThinkAgile, ThinkStation, and ThinkSystem series’, were vulnerable to a total of six different vulnerabilities.
These flaws could be abused by threat actors to steal sensitive data, escalate privileges, launch denial of service attacks and, in extreme cases, allow for arbitrary code execution.
Leaking data, risking arbitrary code execution
The flaws Lenovo fixed include CVE-2021-28216 (pointer flaw in TianoCore EDK II BIOS – allows for elevation of privilege and arbitrary code execution), CVE-2022-40134 (information leak flaw in the SMI Set Bios Password SMI Handler – allows for SMM memory reading), CVE-2022-40135 (information leak vulnerability in the Smart USB Protection SMI Handler, allows for SMM memory reading), CVE-2022-40136 (information leak flaw in SMI Handler used for configuring platform settings over WMI, allows for SMM memory reading), CVE-2022-40137 (buffer overflow in the WMI SMI Handler, allows for arbitrary code execution), American Megatrends security enhancements (no CVEs).
The fix for these flaws comes as part of the latest BIOS update for the abovementioned devices, with the company advising all system admins to apply them immediately.
More patches (opens in new tab) are expected to be released before the end of this month, as well as in October, with a short list of models getting their updates early next year.
Those interested in fixing their endpoints (opens in new tab) should navigate to Lenovo’s “Drivers & Software” portal, search for their devices by name, and choose “Manual Update”. That will download the latest BIOS firmware version, which they can then manually install.
You can find the full list of the affected devices on this link (opens in new tab).
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba