New UEFI Firmware Flaws Reported in Several Lenovo Notebook Models

Computer system maker Lenovo has addressed still one more set of a few shortcomings in the Unified Extensible Firmware Interface (UEFI) firmware impacting a number of Yoga, IdeaPad, and ThinkBook gadgets.

“The vulnerabilities allow for disabling UEFI Protected Boot or restoring manufacturing unit default Secure Boot databases (incl. dbx): all just from an OS,” Slovak cybersecurity business ESET described in a series of tweets.

UEFI refers to software program that acts as an interface between the running program and the firmware embedded in the device’s components. Mainly because UEFI is dependable for launching the functioning program when a gadget is driven on, it has designed the technology an appealing possibility for threat actors seeking to drop malware that is tricky to detect and get rid of.

Considered in that mild, the flaws, tracked as CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432, could be abused by an adversary to transform off Protected Boot, a security mechanism that’s developed to stop malicious packages from loading through the boot approach.

Lenovo’s advisory describes the vulnerabilities as follows –

• CVE-2022-3430: A likely vulnerability in the WMI Setup driver on some shopper Lenovo Notebook equipment may perhaps allow for an attacker with elevated privileges to modify Secure Boot setting by modifying an NVRAM variable.

• CVE-2022-3431: A opportunity vulnerability in a driver utilised all through the producing procedure on some client Lenovo Notebook units that was mistakenly not deactivated might make it possible for an attacker with elevated privileges to modify Secure Boot setting by modifying an NVRAM variable.

• CVE-2022-3432: A potential vulnerability in a driver employed for the duration of the production system on the IdeaPad Y700-14ISK that was mistakenly not deactivated might permit an attacker with elevated privileges to modify Secure Boot placing by modifying an NVRAM variable.

In other terms, disabling the UEFI Protected Boot helps make it achievable for danger actors to execute rogue boot loaders, granting the attackers privileges accessibility to the compromised hosts.

ESET explained the vulnerabilities were not lapses in the source code for each se, but somewhat came into becoming simply because the “motorists ended up meant to be utilized only all through the production system but had been mistakenly provided in the manufacturing.”

The latest update marks the third time Lenovo has moved to patch flaws in its UEFI firmware, all of which have been discovered and described by ESET researcher Martin Smolár.

Even though the to start with established of issues (CVE-2021-3970, CVE-2021-3971, and CVE-2021-3972) could have permitted bad actors to deploy and execute firmware implants on the afflicted devices, the 2nd batch (CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892) could be weaponized to realize arbitrary code execution and disable security options.

Lenovo claimed it does not intend to launch fixes for CVE-2022-3432 owing to the point that the design in dilemma has attained close-of-life (EoL). End users of the other impacted products are encouraged to update their firmware to the most current model.

Observed this short article appealing? Abide by THN on Facebook, Twitter  and LinkedIn to go through extra unique articles we post.

Some parts of this article are sourced from:
thehackernews.com