If you own a Lenovo laptop, be aware that researchers at ESET have recently discovered a trio of bugs reported to Lenovo that could allow an attacker to disable security features and hijack your operating system.
The issues are tracked as CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892 and are all classed as medium severity level.
The first of these is an issue in the ReadcyBootDxe driver used in some of Lenovo’s products, while the other two are overflow bugs in the SystemLoadDefaultDxe driver.
Unfortunately, the issue is quite widespread, as the SystemLoadDefaultDxe driver is used in more than 70 different Lenovo models. That includes everything in the IdeaPad, Flex, ThinkBook, V14, V15, V130, Slim, S145, S540, S940, and Yoga product lines.
The company has issued a formal advisory regarding the issue and has a complete listing of all their products impacted by these flaws on their website.
ESET had this to say about their recent discovery:
“These vulnerabilities were caused by insufficient validation of DataSize parameter passed to the UEFI Runtime Services function GetVariable. An attacker could create a specially crafted NVRAM variable, causing buffer overflow of the Data buffer in the second GetVariable call.”
If there’s a silver lining to be found here, it lies in the fact that exploiting these flaws is not a trivial task and requires a skillset that is likely beyond a great many of the world’s hackers.
That does not mean that you are safe. You are very much at risk. The good news though is that at least a casual or relatively inexperienced hacker will not be able to easily exploit these weaknesses. They’re still well worth keeping on your company’s radar, however.
One final note to be aware of is that if you’re having trouble determining whether your Lenovo is on the vulnerable list, the company has published a website that auto-detects for the vulnerability. It is hands down the fastest way to find out for sure. Good luck out there!