Three UEFI Firmware flaws found in tens of Lenovo Notebook models

IT giant Lenovo released security fixes to address three vulnerabilities that impact the UEFI firmware shipped with over 70 product models.

The multinational technology company Lenovo released security fixes to address three vulnerabilities that reside in the UEFI firmware shipped with over 70 product models, including several ThinkBook models.

A remote attacker can trigger these flaws to execute arbitrary code on the vulnerable systems in the early stages of the boot avoiding the detection of security features.

The three buffer overflow vulnerabilities in UEFI firmware, tracked as CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892, were discovered by researchers from ESET.

Below is the list of vulnerabilities in Lenovo Notebook BIOS reported in the vendor’s advisory:

• CVE-2022-1890: A buffer overflow has been identified in the ReadyBootDxe driver in some Lenovo notebook products which may allow an attacker with local privileges to execute arbitrary code.
• CVE-2022-1891: A buffer overflow has been identified in the SystemLoadDefaultDxe driver in some Lenovo notebook products which may allow an attacker with local privileges to execute arbitrary code.
• CVE-2022-1892: A buffer overflow has been identified in the SystemBootManagerDxe driver in some Lenovo notebook products which may allow an attacker with local privileges to execute arbitrary code.

The root cause of the flaws is the insufficient validation of DataSize parameter, which is passed to the UEFI Runtime Services function GetVariable. Threat actors can exploit the flaw by creating a specially crafted NVRAM variable, triggering the buffer overflow of the Data buffer in the second GetVariable call.

“The vulnerabilities can be exploited to achieve arbitrary code execution in the early phases of the platform boot, possibly allowing the attackers to hijack the OS execution flow and disable some important security features.” wrote ESET in a series of tweets. “These vulnerabilities were caused by insufficient validation of DataSize parameter passed to the UEFI Runtime Services function GetVariable. An attacker could create a specially crafted NVRAM variable, causing buffer overflow of the Data buffer in the second GetVariable call.”

ESET researchers pointed out that the issues are “typical UEFI “double GetVariable” vulnerability” that can also be identified in the firmware code by assessing it with IDA plugin efiXplorer @binarly_io. However, ESET did not find the three vulnerabilities by using this plugin because they were not covered by the plugin at the time of discovery.

Owners of affected devices are highly recommended to update to the latest firmware version. The list of models affected by the three issues and the firmware updates are reported in the Lenovo Advisory.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Lenovo)

[adrotate banner=”5″]

[adrotate banner=”13″]