Lenovo issues emergency security patch for hundreds of models
Six high-severity flaws patched by Lenovo
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Lenovohas fixed a number of major BIOS flaws which allow threat actors to potentially launch all kinds of devastating cyberattacks across a wide range of its products, fromdesktop PCs, to laptops.
In a security advisory published earlier this week, the company said that hundreds of its devices, from Desktop, All in One, IdeaCentre, Legion, ThinkCentre, ThinkPad, ThinkAgile, ThinkStation, and ThinkSystem series’, were vulnerable to a total of six different vulnerabilities.
These flaws could be abused by threat actors to steal sensitive data, escalate privileges, launch denial of service attacks and, in extreme cases, allow for arbitrary code execution.
Leaking data, risking arbitrary code execution
The flaws Lenovo fixed include CVE-2021-28216 (pointer flaw in TianoCore EDK II BIOS - allows for elevation of privilege and arbitrary code execution), CVE-2022-40134 (information leak flaw in the SMI Set Bios Password SMI Handler - allows for SMM memory reading), CVE-2022-40135 (information leak vulnerability in the Smart USB Protection SMI Handler, allows for SMM memory reading), CVE-2022-40136 (information leak flaw in SMI Handler used for configuring platform settings over WMI, allows for SMM memory reading), CVE-2022-40137 (buffer overflow in the WMI SMI Handler, allows for arbitrary code execution), American Megatrends security enhancements (no CVEs).
Lenovo Legion gaming laptops hit by major BIOS fail>This serious firmware flaw affects a whole load of Lenovo laptops>These are the best mobile workstations around today
The fix for these flaws comes as part of the latest BIOS update for the abovementioned devices, with the company advising all system admins to apply them immediately.
Morepatchesare expected to be released before the end of this month, as well as in October, with a short list of models getting their updates early next year.
Those interested in fixing theirendpointsshould navigate to Lenovo’s “Drivers & Software” portal, search for their devices by name, and choose “Manual Update”. That will download the latest BIOS firmware version, which they can then manually install.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
You can find the full list of the affected devices onthis link.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Lego will let you build Sir Ernest Shackleton’s iconic lost ship, the Endurance, in its next Icons set
