⚡ TL;DR | Go Straight to the Lenovo BIOS Vulnerabilities Report
LEN-73440: Multiple BIOS Vulnerabilities
Lenovo recently released a new security advisory covering 3 new vulnerabilities in multiple of their models including Ideapad, Legion, Yoga, Flex and more. The first vulnerability seems to be the most severe one, an issue with memory corruption in the System Management Mode (SMM) can lead to code execution with high privileges if exploited.
The remaining two vulnerabilities are a result of a sloppy manufacturing process. During the manufacturing process, specially crafted drivers are used which are supposed to either be deactivated or removed altogether in production versions. However, it seems like this step was forgotten or missed in some cases. Lenovo has listed a short description of all three vulnerabilities:
- CVE-2021-3970: A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- CVE-2021-3971: A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.
- CVE-2021-3972: A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Discover Vulnerable Devices
Lenovo’s security advisory contains a list of all vulnerable devices, and the new BIOS versions released. We’ve used this information to create a special Lansweeper report that will provide a list of all devices in your environment that might be affected by the vulnerabilities while also listing the device’s BIOS data.
