Cyber Security News

Lenovo PC/Laptop Flaws Enable Attackers to Run Arbitrary Code

Lenovo has disclosed multiple BIOS security vulnerabilities affecting several vendors in their new security advisory. The potential impacts of these vulnerabilities could be information disclosure and arbitrary code execution by multiple BIOS vendors. 

Moreover, the scope of impact for these vulnerabilities has been given as “Industry-wide.” There were 26 CVEs reported by Lenovo associated with multiple BIOS vendors, all of which were classified with a High severity.

Summary of Vulnerabilities

CVE-2023-20594 and CVE-2023-20597 existed in AMD and were associated with memory leak vulnerabilities in their AMD DXE driver in server and client desktops and mobile APUs and CPUs, which could allow a highly privileges user to retrieve sensitive information.

Document
Protect Your Storage With SafeGuard

Is Your Storage & Backup Systems Fully Protected? – Watch 40-second Tour of SafeGuard

StorageGuard scans, detects, and fixes security misconfigurations and vulnerabilities across hundreds of storage and backup devices.

CVE-2023-5075 existed in the BIOS of some Lenovo Notebook products, which could allow a local threat actor to elevate their privileges and execute arbitrary code. CVE-2023-5078 existed on the BIOS of some Lenovo ThinkPad products, which could allow a threat actor with physical access to the system to escalate their privileges and modify BIOS firmware.

Desktop, Smart Edge and ThinkStation products were reported with a privilege escalation vulnerability, which could allow a local threat actor to elevate their privileges and execute write-to NVRAM variables. The CVEs for these products were:

Another Privilege Escalation vulnerability was discovered in Lenovo Desktop products, which could allow a local threat actor to elevate their privilege and execute arbitrary code.  These existed in some BIOS of Lenovo Desktop products and were provided with CVEs.

Mitigation

To enhance the security of the affected products, Lenovo strongly advises users to upgrade their system firmware to the most recent version according to their model and the product impact list.

This will effectively address the potential vulnerabilities and ensure a safer and more reliable user experience.

How to Download?

To download the version specified for your product below, follow these steps:

Navigate to the Drivers & Software support site for your product:

Support sites

Lenovo Products (sold worldwide, except in China): https://support.lenovo.com/
Lenovo Products (sold in China): https://newsupport.lenovo.com.cn/
IBM-branded System x Legacy Products: https://www.ibm.com/support/fixcentral/

Step 1: Search for your product by name or machine type.
Step 2: Click Drivers & Software on the left menu panel.
Step 3: Click on Manual Update to browse by Component type.
Step 4: Compare the minimum fixed version for your product from the applicable product table with the latest version posted on the support site.

Affected Products

Products affected by these vulnerabilities include,

  • Desktop
  • Desktop – All in One
  • Hyperscale
  • Lenovo Notebook
  • Smart Edge
  • Smart Office
  • Storage
  • ThinkAgile
  • ThinkEdge
  • ThinkPad
  • ThinkServer
  • ThinkStation
  • ThinkSystem

Users of these products are recommended to upgrade to the latest versions based on their product to fix these vulnerabilities.

Secures your storage & backup systems With StorageGuard – Watch a 40-second Video Tour.

Eswar

Eswar is a Cyber security reporter with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is reporting data breach, Privacy and APT Threats.

Recent Posts

Google Chrome 153 Update Fixes 42 Security Flaws, Including 3 Critical Ones

Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…

4 hours ago

CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology…

14 hours ago

CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory Environments

CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers…

15 hours ago

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple has released one of its largest coordinated security rollouts, addressing 273 distinct critical vulnerabilities…

15 hours ago

How to Keep Malware’s Rotating Infrastructure From Becoming a Detection Gap

You can’t detect today's attacks with yesterday’s threat intelligence; that’s how you could briefly formulate…

15 hours ago

Microsoft Bans Its AI Models From Launching Cyberattacks or Escalating Their Own Access

Microsoft has published a draft Humanist AI Code of Conduct that would prohibit its in-house…

16 hours ago