**Lenovo Security Advisory:** LEN-2015-009 **Potential Impact:** Escalation of Privilege **Severity:** Medium **Summary:** The Passgate issue (aka “Row Hammer”) is an inherent design/process limitation in memory for sub 40nm technology such as DDR3/DDR3L/LPDDR2/LPDDR3/GDDR5 that can cause errors in rows of memory adjacent to rows that are being repeatedly accessed (“hammered”). This is a pervasive industry memory issue. It potentially affects multiple brands of PCs using the memory listed above, and is not unique to Lenovo products. Any sub 40nm (e.g. DDR3) memory made after 2011 and before 2014 may be impacted by this issue. ECC and non-DDR3 derived memory have not been proven to be impacted by this issue. Memory isolation is a key property of reliable and secure systems. Systems and applications accessing one memory address should not have unintended side effects on data stored in another address belonging to other application(s). Row Hammering is not a new phenomenon and has historically been recognized as leading to random data corruption. However, recent security research has demonstrated that Row Hammering non-ECC DDR3-derived memory commonly used in desktops, workstations, and laptops can expose exploitable security vulnerability. This attack requires that an attacker already have logical access to the target computer and then use this code to escalate privileges. The problem occurs when the memory controller under command of malicious software causes an ACTIVATE command to a single row address repetitively. If the physically adjacent rows have not been ACTIVATED or refreshed recently, the charge from the over ACTIVATED row leaks into the dormant adjacent rows and causes a bit to flip. This failure mechanism has been coined ‘Row Hammer’ as a row of memory cells are being ‘hammered’ with ACTIVATE commands. Once this failure occurs, a Refresh command from the Memory Controller solidifies the error into the memory cell. Current understanding is that the charge leakage does not damage the physical memory cell. The security implication of this attack is that a program can corrupt memory pages belonging to another program. **Mitigation Strategy for Customers (what you should do to protect yourself):** Lenovo is working with our memory suppliers in order to ensure that all new DRAM is designed to be Row Hammer-free. For computers with affected DDR3-derived memory, doubling the refresh rate on the memory has been shown to be effective in reducing the risk of successfully exploiting this issue. Memory refresh rate is controlled by the system BIOS. Refer to the Product Impact section to determine if your product may be affected. When the updated BIOS is available for you to download, you will be able to link directly to the download page for the applicable product tab. Affected Products: Please click to expand for more info ![ar](http://download.lenovo.com/km/Media/images/common/ar.png)ThinkPad System | Status | Minimum version including Fix | Link ---|---|---|--- ThinkPad E450 (Broadwell) | Affected | J5ET44WW | ThinkPad E450 (Sharkbay) | Affected | J5ET44WW | ThinkPad E550 (Broadwell) | Affected | J5ET44WW | ThinkPad E550 (Sharkbay) | Affected | J5ET44WW | ThinkPad Edge E130 | Affected | H4ET95WW | ThinkPad Edge E135 | Affected | HMET97WW | ThinkPad Edge E145 | Affected | HSET61WW | Thinkpad Edge E330 | Affected | H3ET75WW | ThinkPad Edge E335 | Affected | HKET72WW | Thinkpad Edge E430/E430c | Affected | H0ET96WW | ThinkPad Edge E431/E531 | Affected | HEET48WW | ThinkPad Edge E435 | Affected | HHET92WW | ThinkPad Edge E440/E540 | Affected | J9ET98WW | ThinkPad Edge E445 | Affected | HRET24WW | ThinkPad Edge E455/E555 | Affected | HTET43WW | Thinkpad Edge E530/E530c | Affected | H0ET96WW | ThinkPad Edge E535 | Affected | HHET92WW | ThinkPad Edge E545 | Affected | HRET24WW | ThinkPad Helix (20CG, 20CH) | Affected | N17ET74W | ThinkPad Helix (3xxx) | Affected | GFET52WW | ThinkPad L330 | Affected | H8ET75WW | ThinkPad L430/L530 | Affected | G3ETA4WW | ThinkPad L440/L540 | Affected | J4ET76WW | ThinkPad L450 (Broadwell) | Affected | JDET49WW | ThinkPad L450 (Sharkbay) | Affected | JDET49WW | ThinkPad S1 Yoga (Non-vPro) | Affected | GQET44WW | ThinkPad S1 Yoga (vPro) | Affected | B0ET28WW | ThinkPad S430 | Affected | GAETA0WW | ThinkPad S431 | Affected | HFET35WW | ThinkPad S440 | Affected | J3ET63WW | ThinkPad S531 | Affected | GKET35WW | ThinkPad S540 | Affected | GPET64WW | ThinkPad T430, T430i | Affected | G1ETA8WW | ThinkPad T430s, T430si | Affected | G7ETA3WW | ThinkPad T430u | Affected | H6ET94WW | [http://support.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t430u/downloads/DS031724]() ThinkPad T431s | Affected | GHET31WW | ThinkPad T440/T440s | Affected | GJET83WW | ThinkPad T440p | Affected | GLET78WW | ThinkPad T450 (Broadwell) | Affected | JBET47WW | ThinkPad T450 (Shark Bay) | Affected | JBET47WW | ThinkPad T450s | Affected | JBET47WW | ThinkPad T530, T530i | Affected | G4ETA4WW | ThinkPad T540p | Affected | GMET70WW | ThinkPad T550 | Affected | N11ET31W | ThinkPad Tablet 10 (32-bit) | Not affected | − | − ThinkPad Tablet 10 (64-bit) | Not affected | − | − ThinkPad Tablet 2 | Affected | − | BIOS update is not supported on this chipset ThinkPad Tablet 8 (32-bit) | Not affected | − | − ThinkPad Tablet 8 (64-bit | Not affected | − | − ThinkPad Twist/S230u | Affected | GDETB0WW | ThinkPad W530 | Affected | G5ETA2WW | ThinkPad W540/W541 | Affected | GNET73WW | ThinkPad W550s | Affected | N11ET31W | ThinkPad X1 Carbon (20Ax) | Affected | GRET44WW | ThinkPad X1 Carbon (20Bx) | Affected | N14ET28W | ThinkPad X1 Carbon (34xx) | Affected | G6ETB1WW | ThinkPad X131e (AMD) | Affected | G9ETA0WW | ThinkPad X131e (Intel) | Affected | G8ETA1WW | ThinkPad X140e (AMD) | Affected | GSET63WW | ThinkPad X230 Tablet; X230i | Affected | GCETA2WW | ThinkPad X230, X230i | Affected | G2ETA4WW | ThinkPad X230s/X231s | Affected | GGET24WW | ThinkPad X240 | Affected | GIET80WW | ThinkPad X240s | Affected | GIET80WW | ThinkPad X250 (Broadwell) | Affected | N10ET30W | ThinkPad 11e (Type 20ED, 20EE) | Affected | JIET18WW | ThinkPad 11e/Yoga 11e (Type 20D9, 20DA) | Affected | N15ET56W | ThinkPad 11e/Yoga 11e (Broadwell) (Type 20E5, 20E7) | Affected | JHET21WW | ThinkPad Yoga 12 | Affected | JEET59WW | ThinkPad Yoga 14 (Broadwell) | Affected | JFET36WW | ThinkPad Yoga 14 (Sharkbay) | Affected | JGET25WW | ThinkPad Yoga 15 | Affected | N19ET35WW | ![ar](http://download.lenovo.com/km/Media/images/common/ar.png)ThinkCentre System | Status | Minimum version including Fix | Link ---|---|---|--- ThinkCentre E73Z | Affected | FGKT38A | ThinkCentre E93 | Affected | FBKTA7A | ThinkCentre E93Z | Affected | FFKT38A | ThinkCentre Edge 62z | Affected | F8KT37A | ThinkCentre Edge 63z | Affected | FQKT28A | ThinkCentre Edge 72 | Affected | F1KT69A | ThinkCentre Edge 72z | Affected | F6KT40A | ThinkCentre Edge 92z | Affected | 9XKT32A | ThinkCentre M53 | Affected | FRKT37A | ThinkCentre M62Z | Affected | F0KT43A | ThinkCentre M72e (Ivy) | Affected | F1KT69A | ThinkCentre M72e (PCI) | Affected | F9KT55A | ThinkCentre M72e (Tiny) | Affected | F4KT52A | ThinkCentre M72z | Affected | F6KT40A | ThinkCentre M73 | Affected | FCKT69A | ThinkCentre M73 Tiny | Affected | FHKT57A | ThinkCentre M73Z | Affected | FGKT38A | ThinkCentre M78 (type 10BN, 10BQ, 10BR, 10BS, 10BT, 10BU) | Affected | FNKT41A | ThinkCentre M79 | Affected | FPKT33A | ThinkCentre M83 | Affected | FBKTA7A | ThinkCentre M83Z | Affected | FGKT38A | ThinkCentre M92 | Affected | 9SKT88A | ThinkCentre M92P | Affected | 9SKT88A | ThinkCentre M92Z | Affected | 9NKT66A | ThinkCentre M93 | Affected | FBKTA7A | ThinkCentre M93P | Affected | FBKTA7A | ThinkCentre M93P Tiny | Affected | FBKTA7A | ThinkCentre M93Z | Affected | FEKT90A | ![ar](http://download.lenovo.com/km/Media/images/common/ar.png)ThinkStation System | Status | Minimum version including Fix | Link ---|---|---|--- ThinkStation C30 (type 1095, 1096, 1097) | Affected | A1KT53A | ThinkStation C30 (type 1136, 1137) | Affected | A3KT50A | ThinkStation D30 (type 4223, 4228, 4229) | Affected | A1KT53A | ThinkStation D30 (type 4353, 4354) | Affected | A3KT50A | ThinkStation E31 | Affected | 9SKT88A | ThinkStation E32 | Affected | FBKTA7A | ThinkStation P300 | Affected | FBKTA7A | ThinkStation P500 | Not affected | − | − ThinkStation P700 | Not affected | − | − ThinkStation P900 | Not affected | − | − ThinkStation S30 (type 0567, 0568, 0569, 0606) | Affected | A0KT53A | ThinkStation S30 (type 4351, 4352) | Affected | A2KT50A | ![ar](http://download.lenovo.com/km/Media/images/common/ar.png)ThinkServer & Storage System | Status | Minimum version including Fix | Link ---|---|---|--- ThinkServer RD330 | Affected | BIOS v9.4 | ThinkServer RD340 | Not affected | | Initial shipment included mitigation ThinkServer RD350 | Not affected | | Initial shipment included mitigation ThinkServer RD430 | Affected | BIOS v9.4 | ThinkServer RD440 | Not affected | | Initial shipment included mitigation ThinkServer RD450 | Not affected | | Initial shipment included mitigation ThinkServer RD530 | Affected | BIOS v9.4 | ThinkServer RD540 | Not affected | | Initial shipment included mitigation ThinkServer RD550 | Not affected | | Initial shipment included mitigation ThinkServer RD630 | Affected | BIOS v9.4 | ThinkServer RD640 | Not affected | | Initial shipment included mitigation ThinkServer RD650 | Not affected | | Initial shipment included mitigation ThinkServer RQ940 | Not affected | | Initial shipment included mitigation ThinkServer RS140 | Affected | FBKT86C | ThinkServer TD340 | Not affected | | Initial shipment included mitigation ThinkServer TD350 | Not affected | | Initial shipment included mitigation ThinkServer TS130 | Affected | FAKT29BUS | ThinkServer TS140 | Affected | FBKTA8A | ThinkServer TS240 | Affected | FBKTA8A | ThinkServer TS440 | Affected | FBKTA8A | ThinkServer TS540 | Affected | FBKTA8A | ![ar](http://download.lenovo.com/km/Media/images/common/ar.png)Lenovo EMC System | Status | Minimum version including Fix | Link ---|---|---|--- LenovoEMC EZ Media & Backup (hm3) | Not affected | − | − LenovoEMC Home Media Cloud Edition (hm2) | Not affected | − | − LenovoEMC ix12-300r | Not affected | − | − LenovoEMC ix2 (inc DL) | Not affected | − | − LenovoEMC ix2-200 | Not affected | − | − LenovoEMC ix2-200 Cloud Edition | Not affected | − | − LenovoEMC ix4-200d | Not affected | − | − LenovoEMC ix4-200d (2.1.x firmware) | Not affected | − | − LenovoEMC ix4-200d Cloud Edition | Not affected | − | − LenovoEMC ix4-300d (inc DL) | Not affected | − | − LenovoEMC px12-350r | Not affected | − | − LenovoEMC px12-400r | Not affected | − | − LenovoEMC px12-450r | Not affected | − | − LenovoEMC px2-300d (inc NVR) | Not affected | − | − LenovoEMC px4-300r | Not affected | − | − LenovoEMC px4-400d (inc NVR) | Not affected | − | − LenovoEMC px4-400r | Not affected | − | − ![ar](http://download.lenovo.com/km/Media/images/common/ar.png)Lenovo Notebook System | Status | Minimum version including Fix | Link ---|---|---|--- B40-30 | Affected | 9CCN31WW(V2.09) | B40-45 | Not Affected | − | − B40-70 | Affected | 9DCN32WW(V3.02) | B490 | Affected | H9ET90WW | B50-30 | Affected | 9CCN31WW(V2.09) | B50-45 | Not Affected | − | − B50-70 | Affected | 9DCN32WW(V3.02) | E10-30 | Not Affected | − | − E40-30 | Affected | 9CCN31WW(V2.09) | E40-70 | Affected | 9DCN32WW(V3.02) | E50-70 | Affected | 9DCN32WW(V3.02) | Flex 10 | Not Affected | − | − Flex 2 14 (Broadwell) | Not Affected | − | − Flex 2 14 (Haswell) | Affected | A0CN35WW | Flex 2 14 (Baytrail-M) | Not Affected | − | − Flex 2 14D/ Flex2 15D | Affected | 9FCN25WW | Flex 2 Pro-15 (Broadwell) | Not Affected | − | − Flex 2 Pro-15 (Haswell) | Affected | B9CN16WW | Flex 3 11 | Not Affected | − | − Flex 3 1470 (Broadwell) | Not Affected | − | − Flex 3 1470 (Haswell) | Affected | BDCN30WW | Flex 3 1475 | Not Affected | − | − Flex 3 1535 | Not Affected | − | − Flex3 1570 (Broadwell) | Not Affected | − | − Flex3 1570 (Haswell) | Affected | BDCN30WW | Flex3 1575 | Not Affected | − | − G40-30 | Not Affected | − | − G40-45 | Not Affected | − | − G40-70 | Not Affected | − | − G40-75 | Not Affected | − | − G40-80 (Broadwell) | Not Affected | − | − G41-35 | Not Affected | − | − G50-30 | Not Affected | − | − G50-45 | Not Affected | − | − G50-70 | Not Affected | − | − G50-75 | Not Affected | − | − G50-80 (Broadwell) | Not Affected | − | − G51-35 | Not Affected | − | − G70-70 | Not Affected | − | − G70-80 (Broadwell) | Not Affected | − | − K20-80 | Not Affected | − | − K2450 | Affected | J2ET40WW | K4450 | Affected | J8ET43WW | M40-35 | Not Affected | − | − M50-70 | Affected | B3CN23WW | M50-80 | Not Affected | − | − MIIX 2 10 | Not Affected | − | − Miix 2 11 | Not Affected | − | − Miix 2 8 | Not Affected | − | − Miix 3 10 | Not Affected | − | − S20-30 | Not Affected | − | − S41-70 | Not Affected | − | − S435 | Not Affected | − | − Y40-80 | Affected | B5CN36WW(V2.02) | Y410/Y510 | Not Affected | − | − Y430P | Not Affected | − | − Y50-70 | Affected | 9ECN37WW(V2.01) | Y70-70 | Affected | 9ECN37WW(V2.01) | Yoga 2 13 | Affected | 96CN30WW(V1.16) | Yoga 2 11 (Baytrail-M) | Not Affected | − | − Yoga2 11 (Haswell) | Not Affected | − | − Yoga2 Pro | Affected | 76CN46WW | Yoga3 14 | Not Affected | − | − Yoga3 Pro | Not Affected | − | − Z40-70 | Not Affected | − | − Z40-75 | Not Affected | − | − Z40-80 (Broadwell) | Not Affected | − | − Z50-70 | Not Affected | − | − Z50-75 | Not Affected | − | − Z50-80 (Broadwell) | Not Affected | − | − Z70-70 | Not Affected | − | − Z70-80 (Broadwell) | Not Affected | − | − ![ar](http://download.lenovo.com/km/Media/images/common/ar.png)Lenovo Desktop System | Status | Minimum version including Fix | Link ---|---|---|--- 63 Desktop | Affected | FCKT69A | A540 All In One (Broadwell) | Affected | O14KT15AUS | A740 All-In-One - BDW | Affected | O14KT15AUS | B40-30 All-In-One | Affected | O0CKT23A | B40-30 Touch All-In-One | Affected | O0CKT23A | B50-30 All-In-One | Affected | O0BKT21A | B50-30 Touch All-In-One | Affected | O0BKT21A | B5035 | Affected | O0AKT18AUS | B50-35 All-In-One | Affected | O0AKT18AUS | C20-05 All-In-One | Affected | O0GKT30AUS | C20-30 All-In-One | Affected | O0EKT30AUS | C260 All--In-One | Affected | IXKT26AUS | C260 Touch All-In-One | Affected | IXKT26AUS | C360 All-In-One | Affected | IMKT19AUS | C365 All-In-One | Affected | O0MKT13A | C40-05 All-In-One | Affected | O0KKT15AUS | C40-30 All-In-One | Affected | O0HKT17AUS | C460 All-In-One | Affected | IMKT19AUS | C470 All-In-One | Affected | O0DKT18AUS | C50-30 All-In-One | Affected | O0IKT17A | C5030-non-Touch | Affected | O0IKT17A | C560 All-In-One | Affected | INKT30AUS | E50-00 Deskop | Affected | O07KT52AUS | ErazerX700 Desktop | Affected | IUKT19AUS | H30-00 Desktop | Affected | O07KT52AUS | H30-05 Desktop | Affected | O06KT18A | H30-50 Desktop | Affected | IEKT31A | H50-00 Desktop | Affected | O07KT52AUS | H50-05 Desktop | Affected | O06KT18A | H50-30g Desktop | Affected | IEKT31A | H50-50 Desktop | Affected | IEKT31A | H530 Desktop | Affected | IEKT31A | H530s Desktop | Affected | IEKT31A | Horizon 2 27 Table PC | Affected | O02KT21A | Horizon2e Table PC | Affected | O08KT22A | Horizon2s Table PC | Affected | O0FKT16A | M4350 Desktop | Affected | F9KT55A | S40-40 All-In-One | Affected | IZKT22A | **Acknowledgements: **None **Other information and references:** * * **Revision History:** **Revision ** | **Date** | **Description ** ---|---|--- 1.6 | 15 Sep 2015 | Publish additional fixes 1.5 | 27 Aug 2015 | Publish additional fixes 1.4 | 05 Aug 2015 | Publish additional fixes 1.3 | 30 Jun 2015 | Publish additional fixes 1.2 | 15 May 2015 | Publish additional fixes 1.1 | 14 Apr 2015 | Publish additional fixes 1.0 | 13 Mar 2015 | Initial release