System x Secure Boot Vulnerability - Lenovo Support US

Lenovo Security Advisory: LEN-20241

Potential Impact: Booting unauthenticated code

Severity: High

Scope of Impact: Lenovo-only

CVE Identifier: CVE-2017-3775

Summary Description:

Lenovo internal testing discovered some System x server BIOS/UEFI versions that, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.

Lenovo ships these systems with Secure Boot disabled by default, because signed code is relatively new in the data center environment, and standard operator configurations disable signature checking.

Mitigation Strategy for Customers (what you should do to protect yourself):

Apply the BIOS/UEFI update appropriate for your model described in the product impact section below. If you are relying on Secure Boot, you may want to control physical access to systems prior to applying the updates.