Intel Active Management Technology MEBx Access Control Bypass - US

Lenovo Security Advisory: LEN-19568 Potential Impact: Remote access and control Severity: Critical Scope of Impact: Industry-wide Summary Description: Intel has issued an advisory for Intel vPro Active Management Technology AMT to all system manufacturers. The Intel AMT default configuration has...

Intel’s ‘Virtual Fences’ Spectre Fix Won’t Protect Against Variant 4

Spectre and Meltdown fixes for Intel chips announced in March, to be embedded into new CPUs, do not address the newly disclosed Variant 4, sources said. Intel introduced hardware-based safeguards to its new chips to protect against the Spectre and Meltdown flaws that rocked the silicon industry...

CVE-2018-3639 - Citrix XenServer Security Update

Description of Problem CVE-2018-3639 Speculative Store Bypass Disable is an issue that may affect third-party software that runs in guest VMs on Citrix XenServer. This is not an issue caused by Citrix XenServer and Citrix is unaware of any means of exploiting this issue against XenServer itself...

Dell Inspiron systems Absolute Computrace Agent Competitive Condition Vulnerability

Dell Inspiron systems is a set of BIOS systems for the Spirit Series from Dell, U.S.A. Absolute Computrace Agent is one of the agent programs used to monitor computer systems. A competitive condition vulnerability exists in Dell Inspiron systems 2009 and prior versions of Absolute Computrace Agen...

CVE-2009-5151

The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior,...

Design/Logic Flaw

The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior,...

CVE-2009-5151

The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior,...

CVE-2009-5151

The CVE-2009-5151 entry concerns the Absolute Computrace Agent, specifically its stub component in V70.785. The vulnerability enables code execution from a disk inter-partition space without requiring a digital signature, allowing a local privileged attacker to influence BIOS behavior and maintai...

Lenovo Patches Arbitrary Code Execution Flaw

Lenovo issued a pair of security advisories on Friday for its popular ThinkPad line and System x servers. One bug is tied to an authentication flaw in the Secure Boot process; and the other to a vulnerability that would allow for arbitrary code execution. The company’s internal testing team...

Code injection

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

CVE-2017-3775

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

CVE-2017-3775

CVE-2017-3775 affects Lenovo System x server BIOS/UEFI where, when Secure Boot is enabled, some versions fail to properly authenticate signed code before boot. This could allow an attacker with physical access to boot unsigned code. Lenovo’s advisory LEN-20241 recommends applying the relevant BIO...

CVE-2017-3775

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

AMD Rolls Out Spectre Fixes

AMD said that CPU firmware and Windows 10 patches are now available to safeguard its products against the Spectre security flaw. Mark Papermaster, senior vice president and chief technology officer at AMD, said in a Tuesday post that Spectre fixes are available for AMD customers, who can download...

BIOS SMI Handler Input Validation Failures - US

Lenovo Security Advisory: LEN-14695 Potential Impact: Execution of code in System Management Mode by an attacker with local administrative access Severity: High Scope of Impact: Industry-Wide CVE Identifier: CVE-2017-3753 Summary Description: A vulnerability has been identified in some Lenovo...

BIOS SMI Handler Input Validation Failures - Lenovo Support US

No description provided...

Intel SGX Update and Attestation Key Recovery - Lenovo Support US

No description provided...

Intel SGX Update and Attestation Key Recovery - US

Lenovo Security Advisory: LEN-15184 Potential Impact: Elevation of Privilege / Information Disclosure Severity: High Scope of Impact: Industry Wide CVE Identifier: CVE-2017-5691 Summary Description: Intel has discovered a vulnerability that could impact the security of Intel® Software Guard...

The vulnerability affects the implementation of the AMD Secure Processor technology in CPUs such as Ryzen, Ryzen Pro, Ryzen Mobile, and EPYC Server. This allows malicious code to be injected into a computer’s BIOS.

The vulnerability of AMD Secure Processor-based processors, such as Ryzen, Ryzen Pro, Ryzen Mobile, and EPYC Server, stems from the absence of a mechanism for detecting damage to flash memory contents. Exploiting this vulnerability allows an attacker who has access to the targeted computer and...

The vulnerability affects the implementation of the AMD Secure Processor technology in CPUs such as Ryzen, Ryzen Pro, Ryzen Mobile, and EPYC Server. This allows malicious code to be injected into a computer’s BIOS.

The vulnerability of AMD Secure Processor-based processors, such as Ryzen, Ryzen Pro, Ryzen Mobile, and EPYC Server, stems from the absence of a mechanism for detecting damage to flash memory contents. Exploiting this vulnerability allows an attacker who has access to the targeted computer and...