Lenovo patches ThinkPad, Yoga, IdeaPad UEFI secure boot vulnerability

Lenovo has produced patches to address two vulnerabilities that could have allowed cyber criminals to operate destructive code as a result of the deactivation of UEFI Secure Boot.

Scientists at ESET very first identified the vulnerabilities, tracked as CVE-2022-3430 and CVE-2022-3431, which, if exploited, could lead to menace actors circumventing the simple security capabilities of a victim’s working process (OS). These bugs carry a severity score of ‘high’.

The vulnerabilities have an impact on 25 units across the ThinkBook, Yoga and IdeaPad ranges in complete, while not all these units are affected by equally vulnerabilities. As these gadgets are closely used in organization settings, personnel could be adversely impacted by the flaw and likely sustain damage to sensitive facts.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The flaw, which sits in just a driver in the influenced products, lets for attackers to change a variable in non-risky random access memory (NVRAM) to modify the secure boot environment of a gadget. This was not due to an mistake in the code of the afflicted drivers, but rather mainly because the influenced gadgets were being mistakenly geared up with motorists intended for use only during manufacturing, with peaceful regulate about protected boot settings from inside the OS.

UEFI flaws are severe, as they allow for for danger actors to change critical product processes, and potentially set up malware in just the victim’s flash memory. For instance, risk actors could use this sort of a flaw to put in a rootkit, which could have out destructive action when remaining really tricky to detect, and can even survive OS reinstallation.

“Secure boot is built on a hierarchy of have faith in normally rooted in technologies mounted in the hardware of a product,” Professor John Goodacre, director of the UKRI’s Digital Security by Design and style obstacle and professor of laptop architectures at the University of Manchester.

“Such techniques are applied to be certain that irrespective of any exploitation of a vulnerability during the usual operation of a method it can be recovered by way of a reboot. It is for that reason necessary that by structure, the protected boot of a system are unable to be altered although in usual operation. Unfortunately, all software need to be deemed to consist of vulnerabilities, and therefore it’s necessary that in the course of typical operation no mechanisms can circumvent secure boot.  

“Although a shift to working with digital protected by style execution of software package will substantially lessen the opportunity to exploit vulnerabilities, any mechanism in which an exploitation of ordinary functions can get management of secure boot signifies they are open to ransomware and other denial of assistance attacks and highlights the have to have for rely on throughout the numerous factors of secure boot.”

The Ideapad Y700-14ISK is afflicted by a third vulnerability, tracked as CVE-2022-3432, which contains an additional driver flaw that effects in a identical modification of the secure boot perspiring. Even so, Lenovo will not launch a resolve for this as the product has exceeded its developer assist lifecycle.

This is not the initially time that Lenovo has had to launch this sort of a patch. In April, ESET researchers uncovered far more than 100 Lenovo designs susceptible to UEFI malware attacks, also as a consequence of manufacturing drivers mistakenly still left on the products.

Similar concerns have been elevated in the earlier, with Dell BIOS vulnerabilities found in 2021 enabling threat actors to execute destructive code at UEFI amount on an estimated 30 million products, and scientists from Superior Intelligence and Eclypsium possessing uncovered a variant of the Trickbot malware that can brick gadgets at UEFI stage in 2020. 

ESET suggests that those people working with the impacted gadgets update their firmware version right away.