How to Fix the 3 New Vulnerabilities in Lenovo UEFI?

Martin Smolár, a security researcher from ESET, has disclosed 3 new vulnerabilities in Lenovo UEFI. The vulnerability is impacting multiple Lenovo consumer Notebook models like Yoga, IdeaPad, and ThinkBook devices leaving millions of laptops vulnerable. These vulnerabilities allows advisories to disable UEFI Secure Boot or restoring factory default Secure Boot databases (incl. dbx) all simply from an OS on the affected devices. It is highly important for all the Lenovo Laptop holders to be aware of these three vulnerabilities. We created this post that tells you how to fix the 3 new vulnerabilities in Lenovo UEFI.

Before we begin exploring the 3 New Vulnerabilities In Lenovo UEFI, it is good to learn what is UEFI, what makes it different then BIOS, and what is a Secure Boot in UEFI. Without further due let’s get started.

What Is a Secure Boot in UEFI?

Sometimes, you may get confused between UEFI and BIOS. Here is a small note that lets you know the difference between UEFI and BIOS in simple words.

UEFI is the successor to BIOS, offering a more modern interface as well as additional features and capabilities. UEFI stands for Unified Extensible Firmware Interface and is essentially a software program that sits on top of your computer’s hardware and provides an interface between the operating system and the hardware.

BIOS, on the other hand, stands for Basic Input/Output System. It is a ROM chip that stores information about your computer’s hardware and how it should be configured. The BIOS is responsible for booting up your computer, and it generally does not offer as many features or capabilities as UEFI.

So, UEFI is a more modern version of BIOS that offers additional features and capabilities. It is not required on all computers, but it is becoming more common. If your computer has UEFI, you will likely see a UEFI options menu when you boot up the computer that will allow you to change UEFI settings.

What Is a Secure Boot in UEFI?

Secure boot is a feature of UEFI that allows the system to verify the authenticity of the operating system and other software components before allowing them to be loaded and executed. This helps to ensure that only trusted software can be run on the system, and helps to prevent malicious code from being installed or executed.

In order for secure boot to work, the system must first be configured with a set of trusted digital signatures. These signatures are used to verify the authenticity of the software components that are being loaded and executed. The system will only allow software components with a valid digital signature to be loaded and executed. This helps to ensure that only trusted software can run on the system.

Summary of the 3 New Vulnerabilities in Lenovo UEFI:

On November 2021, Martin Smolár, a security researcher from ESET reported the three flaws to the PC manufacturer. The vulnerabilities tracked as CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432 let attackers to turn off Secure Boot, a feature of UEFI that allows the system to verify the authenticity of the operating system and other software components before allowing them to be loaded and executed.

Let’s see the summary of the three vulnerabilities CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432.

The vulnerability is stemmed from WMI Setup driver, which is used only during the manufacturing phase. But somehow it was mistakenly left in the production devices. This flaw allows an adversary with elevated privileges to modify Secure Boot setting by modifying an NVRAM variable.

List of Lenovo Laptops Vulnerable to the Flaws:

Lenovo has verified its Laptop modules and published the vulnerable models in its advisory report. Please don’t miss to see the list of Notebook models.

How to Fix the 3 New Vulnerabilities in Lenovo UEFI?

Upgrading the firmware in Lenovo Laptops is the best way to fix these new vulnerabilities.

BIOS can be updated in three different ways in Lenovo Laptops.

Method 1: Automatic Update

Update Lenovo drivers, BIOS, and applications using Lenovo System Update. Lenovo System Update is the latest program that can be used to update your Lenovo laptop drivers and other software. It can also detect when there are new versions of the BIOS and automatically install them.