UEFI Flaws Exposes Lenovo Laptops - Threatwire
Added 2022-04-28 16:25:02 +0000 UTCBy Shannon Morse, ThreatWire
Lenovo has their Unified Extensible Firmware Interface (AKA UEFI) available on 100+ laptop models and these are vulnerable to three problems which were discovered by ESET researchers and responsibly disclosed to Lenovo in October of 2021. The issues were patched in security updates. This could potentially affect millions of Lenovo customers since their list of affected devices includes popular models such as IdeaPads, Legion laptops, Yogas and more.
The first two flaws stem from a couple of firmware drivers called SecureBackDoor and SecureBackDoorPeim, which are used during manufacturing, introduced into production models. CVE-2021-3971 is caused by a driver that is used in older manufacturing processes making it’s way into consumer Lenovo notebook devices. This was mistakenly included in the BIOS image and could allow for privilege escalation and the ability for an attacker to modify firmware protection.
The second flaw is CVE-2021-3972, which also is a manufacturing driver that shouldn’t have been in consumer notebooks. This one wasn’t deactivated and could allow an attacker to gain privilege escalation to modify secure book settings.
The third problem is CVE-2021-3970. This one could give a local attacker privilege escalation and the ability to execute arbitrary code. In all three flaws, an attacker could gain persistence so their attack could survive through a system reboot.
UEFI flaws are important because they’re harder to detect and operating system mitigation techniques are generally useless against them because the UEFI sets up boot processes before it hands control over to the operating system for the user.
Lenovo recommends users update system firmware versions from the support page manually for their device or by using Lenovo tools to update system drivers from within the OS.
LINKS:
https://thehackernews.com/2022/04/new-lenovo-uefi-firmware.html
https://support.lenovo.com/ro/en/product_security/len-73440#Lenovo%20Notebook
https://support.lenovo.com/ro/en/solutions/ht504759
