PC maker Lenovo has addressed yet another set of three shortcomings in the Unified Extensible Firmware Interface (UEFI) firmware affecting several Yoga, IdeaPad, and ThinkBook devices.
โThe vulnerabilities allow disabling UEFI Secure Boot or restoring factory default Secure Boot databases (incl. dbx): all simply from an OS,โ Slovak cybersecurity firm ESET explained in a series of tweets.
UEFI refers to software that acts as an interface between the operating system and the firmware embedded in the deviceโs hardware. Because UEFI is responsible for launching the operating system when a device is powered on, it has made the technology an attractive option for threat actors looking to drop malware thatโs difficult to detect and remove.
Viewed in that light, the flaws, tracked as CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432, could be abused by an adversary to turn off Secure Boot, a security mechanism thatโs designed to prevent malicious programs from loading during the boot process.
Lenovoโs advisory describes the vulnerabilities as follows -
In other words, disabling the UEFI Secure Boot makes it possible for threat actors to execute rogue boot loaders, granting the attackers privileges access to the compromised hosts.
ESET said the vulnerabilities werenโt lapses in the source code per se, but rather came into being because the โdrivers were meant to be used only during the manufacturing process but were mistakenly included in the production.โ
The latest update marks the third time Lenovo has moved to patch flaws in its UEFI firmware, all of which have been discovered and reported by ESET researcher Martin Smolรกr.
While the first set of issues (CVE-2021-3970, CVE-2021-3971, and CVE-2021-3972) could have permitted bad actors to deploy and execute firmware implants on the affected devices, the second batch (CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892) could be weaponized to achieve arbitrary code execution and disable security features.
Lenovo said it does not intend to release fixes for CVE-2022-3432 owing to the fact that the model in question has reached end-of-life (EoL). Users of the other impacted devices are recommended to update their firmware to the latest version.
Found this article interesting? Follow THN on Facebook, Twitter ๏ and LinkedIn to read more exclusive content we post.