Lenovo Several High-Severity BIOS Vulnerabilities Impacts Hundreds of Devices

Recently, Lenovo’s new BIOS updates fixes the high-severity vulnerabilities impacting hundreds of devices in several models (Desktop, All in One, IdeaCentre, Legion, ThinkCentre, ThinkPad, ThinkAgile, ThinkStation, ThinkSystem).

The potential impact may include Information disclosure, privilege escalation and denial of service.

The List of Vulnerabilities Includes:

  • CVE-2021-28216 – Fixed pointer vulnerability in TianoCore EDK II BIOS that allow an attacker with local access and elevated privileges to execute arbitrary code. TianoCore EDK II is the foundational open source UEFI (BIOS) code used throughout industry in all modern computers.
  • CVE-2022-40134 – Information leak vulnerability found in the SMI Set BIOS Password SMI Handler, allow an attacker with local access and elevated privileges to read SMM memory.
  • CVE-2022-40135 – Information leak vulnerability in the Smart USB Protection SMI Handler, allow an attacker with local access and elevated privileges to read SMM memory.
  • CVE-2022-40136 – Information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models, allow an attacker with local access and elevated privileges to read SMM memory.
  • CVE-2022-40137 – Buffer overflow in the WMI SMI Handler, allow an attacker with local access and elevated privileges to execute arbitrary code.

American Megatrends security enhancements (AMI), no CVE available.

To Download the Latest Version:

  • Search for your product by name or machine type.
  • Click Drivers & Software on the left menu panel.
  • Click on Manual Update.

Recommendation

According to the Lenovo’s security advisory, “Update system firmware to the version (or newer) indicated for your model”.

The company has fixed the issues in the new BIOS updates for impacted products. Remaining fixes are expected by the end of September and October and few models may receive patches in the upcoming year.

The complete list of the impacted computer models and the BIOS firmware version that addresses the vulnerabilities are included in the ‘Security Advisory’, with links to the download portal for each model.

Download Free SWG – Secure Web Filtering – E-book

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

3 hours ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

4 hours ago

GenAI Assistant DIANNA Uncovers New Obfuscated Malware

Deep Instinct’s GenAI-powered assistant, DIANNA, has identified a sophisticated new malware strain dubbed BypassERWDirectSyscallShellcodeLoader. This…

4 hours ago

Hackers Expose 184 Million User Passwords via Open Directory

A major cybersecurity incident has come to light after researcher Jeremiah Fowler discovered a publicly…

5 hours ago

New Formjacking Malware Targets E-Commerce Sites to Steal Credit Card Data

A disturbing new formjacking malware has emerged, specifically targeting WooCommerce-based e-commerce sites to steal sensitive…

5 hours ago

GitLab Duo Vulnerability Exploited to Inject Malicious Links and Steal Source Code

A security vulnerability was recently discovered in GitLab Duo, the AI-powered coding assistant integrated into…

5 hours ago