Lenovo issues emergency security patch for hundreds of models
>
Lenovo has fixed a number of major BIOS bugs that could potentially allow threat actors to launch a variety of devastating cyberattacks across a wide range of its products, from desktop PCs (opens in new tab)to laptops.
In a security advisory published earlier this week, the company said hundreds of its devices, from Desktop, All in One, IdeaCentre, Legion, ThinkCentre, ThinkPad, ThinkAgile, ThinkStation and ThinkSystem series, were vulnerable to a total of six different vulnerabilities. .
These vulnerabilities can be exploited by threat actors to steal sensitive data, increase privileges, perform denial-of-service attacks and, in extreme cases, allow arbitrary code execution.
Leaking data, risking arbitrary code execution
Bugs that Lenovo has fixed include CVE-2021-28216 (Pointer Error in TianoCore EDK II BIOS – Allows elevation of privilege and arbitrary code execution), CVE-2022-40134 (Error in Information Leak in the SMI Set Bios Password SMI Handler – provides SMM memory readout), CVE-2022-40135 (information leak vulnerability in the Smart USB Protection SMI Handler, allows reading of SMM memory), CVE-2022-40136 (information leak flaw in SMI Handler used to configure from platform settings via WMI, allows reading of SMM memory), CVE-2022-40137 (buffer overflow in the WMI SMI Handler, allows arbitrary code execution), US Megatrends security enhancements (no CPUs).
The fix for these errors is provided as part of the latest BIOS update for the aforementioned devices, with the company advising all system administrators to apply it immediately.
more patches (opens in new tab) are expected to be released before the end of this month and in October, with a short list of models getting their updates early next year.
Those interested in fixing their endpoints (opens in new tab) must go to Lenovo’s “Drivers & Software” portal, search for their devices by name and choose “Manual update”. That will download the latest BIOS firmware version, which they can then install manually.
You can find the full list of affected devices at this link (opens in new tab).
Through: BleepingComputer (opens in new tab)