How to Fix the 3 New Vulnerabilities in Lenovo UEFI?

Martin Smolár, a security researcher from ESET, has disclosed 3 new vulnerabilities in Lenovo UEFI. The vulnerability is impacting multiple Lenovo consumer Notebook models like Yoga, IdeaPad, and ThinkBook devices leaving millions of laptops vulnerable. These vulnerabilities allows advisories to disable UEFI Secure Boot or restoring factory default Secure Boot databases (incl. dbx) all simply from an OS on the affected devices. It is highly important for all the Lenovo Laptop holders to be aware of these three vulnerabilities. We created this post that tells you how to fix the 3 new vulnerabilities in Lenovo UEFI.

Before we begin exploring the 3 New Vulnerabilities In Lenovo UEFI, it is good to learn what is UEFI, what makes it different then BIOS, and what is a Secure Boot in UEFI. Without further due let’s get started.

What Is a Secure Boot in UEFI?

Sometimes, you may get confused between UEFI and BIOS. Here is a small note that lets you know the difference between UEFI and BIOS in simple words.

UEFI is the successor to BIOS, offering a more modern interface as well as additional features and capabilities. UEFI stands for Unified Extensible Firmware Interface and is essentially a software program that sits on top of your computer’s hardware and provides an interface between the operating system and the hardware.

BIOS, on the other hand, stands for Basic Input/Output System. It is a ROM chip that stores information about your computer’s hardware and how it should be configured. The BIOS is responsible for booting up your computer, and it generally does not offer as many features or capabilities as UEFI.

So, UEFI is a more modern version of BIOS that offers additional features and capabilities. It is not required on all computers, but it is becoming more common. If your computer has UEFI, you will likely see a UEFI options menu when you boot up the computer that will allow you to change UEFI settings.

What Is a Secure Boot in UEFI?

Secure boot is a feature of UEFI that allows the system to verify the authenticity of the operating system and other software components before allowing them to be loaded and executed. This helps to ensure that only trusted software can be run on the system, and helps to prevent malicious code from being installed or executed.

In order for secure boot to work, the system must first be configured with a set of trusted digital signatures. These signatures are used to verify the authenticity of the software components that are being loaded and executed. The system will only allow software components with a valid digital signature to be loaded and executed. This helps to ensure that only trusted software can run on the system.

Summary of the 3 New Vulnerabilities in Lenovo UEFI:

On November 2021, Martin Smolár, a security researcher from ESET reported the three flaws to the PC manufacturer. The vulnerabilities tracked as CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432 let attackers to turn off Secure Boot, a feature of UEFI that allows the system to verify the authenticity of the operating system and other software components before allowing them to be loaded and executed.

Let’s see the summary of the three vulnerabilities CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432.

The vulnerability is stemmed from WMI Setup driver, which is used only during the manufacturing phase. But somehow it was mistakenly left in the production devices. This flaw allows an adversary with elevated privileges to modify Secure Boot setting by modifying an NVRAM variable.

List of Lenovo Laptops Vulnerable to the Flaws:

Lenovo has verified its Laptop modules and published the vulnerable models in its advisory report. Please don’t miss to see the list of Notebook models.

How to Fix the 3 New Vulnerabilities in Lenovo UEFI?

Upgrading the firmware in Lenovo Laptops is the best way to fix these new vulnerabilities.

BIOS can be updated in three different ways in Lenovo Laptops.

• Automatic Updates
• WinFlash
• Update BIOS from Windows

Method 1: Automatic Update

Update Lenovo drivers, BIOS, and applications using Lenovo System Update. Lenovo System Update is the latest program that can be used to update your Lenovo laptop drivers and other software. It can also detect when there are new versions of the BIOS and automatically install them.

To check if your Lenovo laptop has this feature, go to Start Menu > Control Panel > System and Security. Click on “System” and then click on “Advanced system settings.” On the left panel, click on “Advanced” and then click on “Update BIOS.”

If you see the “Update BIOS” option, your Lenovo laptop has the Lenovo System Update feature. If you don’t see this option, your Laptop doesn’t have this feature, and you’ll need to install the BIOS updates manually.

Method 2: WinFlash

To use Winflash to install a BIOS update:

1. Download the most recent BIOS to your Windows desktop for easier usage. To locate and download the BIOS, follow these steps: Open the Lenovo support website (support.lenovo.com).
2. Enter the system machine type or product name. On the product page, click Drivers & Software. Filter by BIOS/UEFI, and choose the corresponding OS information.
3. Follow the instructions in the readme file to download and install the BIOS. Right-click on the BIOS flash package and select Run as administrator.
4. A self-extracting window will appear on Windows, and you should click the Install button. Then click on the Flash BIOS button. A caution screen will appear to notify users to connect the system’s power outlet and supply additional flash information.
5. Select the OK button. The BIOS update flashing program will automatically run. Please wait until the BIOS update flashing program has finished installation. When the BIOS update is completed, your computer reboots automatically.

Method 3: Update BIOS From Windows

Updating BIOS from Windows is simple and straight. Steps to update system BIOS in Lenovo Laptops:

1. Visit the official Lenovo website and download the BIOS update file.
2. Extract the downloaded file to a folder on your computer.
3. Double-click on the extracted BIOS file to launch the update process.
4. Follow the on-screen instructions to complete the BIOS update process.
5. Restart your computer and check if the BIOS update is successful.

These are the steps to update the system BIOS in Lenovo Laptops. Following these steps should help you update your BIOS successfully. In case you face any issues, please reach out to the Lenovo support team for assistance.

We hope this post will help you know how to fix the 3 new vulnerabilities in Lenovo UEFI. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this. 

• The 3 New Vulnerabilities In Lenovo BIOS
• How To Fix The Three Buffer Overflow Vulnerabilities In Lenovo BIOS
• How To Fix The 3 New Vulnerabilities In Lenovo BIOS?
• 12 Best Security Settings in Windows 11
• How to Protect Your Private NPM Packages Being Exposed Using NPM API Timing Attack