How To Fix The 3 New Vulnerabilities In Lenovo BIOS?

Martin Smolár, a security researcher from ESET, has disclosed 3 new vulnerabilities in Lenovo BIOS. The vulnerability is impacting multiple Lenovo consumer Laptop models leaving millions of laptops vulnerable. These vulnerabilities enable advisories to deploy and execute malicious firmware on the affected devices. It is highly important for all the Lenovo Laptop holders to be aware of these three vulnerabilities. We created this post that tells how to fix the 3 new vulnerabilities in Lenovo BIOS.

A small Note On UEFI vs BIOS:

Sometimes, you may get confused between UEFI and BIOS. Here is a small note that lets you know the difference between UEFI and BIOS in simple words.

UEFI is the successor to BIOS, offering a more modern interface as well as additional features and capabilities. UEFI stands for Unified Extensible Firmware Interface and is essentially a software program that sits on top of your computer’s hardware and provides an interface between the operating system and the hardware.

BIOS, on the other hand, stands for Basic Input/Output System. It is a ROM chip that stores information about your computer’s hardware and how it should be configured. The BIOS is responsible for booting up your computer, and it generally does not offer as many features or capabilities as UEFI.

So, UEFI is a more modern version of BIOS that offers additional features and capabilities. It is not required on all computers, but it is becoming more common. If your computer has UEFI, you will likely see a UEFI options menu when you boot up the computer that will allow you to change UEFI settings.

List Of The 3 New Vulnerabilities In Lenovo BIOS:

On October 11, 2021, Martin Smolár, a security researcher from ESET reported the three flaws to the PC manufacturer. The following is a summary of the three vulnerabilities as outlined by Lenovo.

• CVE-2021-3970: An issue in Lenovo’s Variable SMI Handler, which is responsible for controlling and managing the SMIMissing validation of some Lenovo Notebook models, may allow a local user with elevated privileges to run arbitrary code on affected platforms.

• CVE-2021-3971: A vulnerability in the BIOS that may be triggered by a driver utilized during past manufacturing processes on some consumer Lenovo Notebook devices might allow an attacker with elevated permissions to modify the firmware protection zone via changing an NVRAM variable.

• CVE-2021-3972: A flaw allows an attacker with elevated privileges may be able to modify secure boot settings by modifying an NVRAM variable. This is a potential vulnerability in the manufacturing process on some consumer Lenovo Notebook devices mistakenly left active.

How To Fix The 3 New Vulnerabilities In Lenovo BIOS?

Upgrading the BIOS firmware is the best way to fix these new vulnerabilities in Lenovo Laptops.
BIOS can be updated in three different ways in Lenovo Laptops.

• Automatic Updates
• WinFlash
• Update BIOS from Windows

Method 1: Automatic Update

Update Lenovo drivers, BIOS, and applications using Lenovo System Update. Lenovo System Update is the latest program that can be used to update your Lenovo laptop drivers and other software. It can also detect when there are new versions of the BIOS and automatically install them.

To check if your Lenovo laptop has this feature, go to Start Menu > Control Panel > System and Security. Click on “System” and then click on “Advanced system settings.” On the left panel, click on “Advanced” and then click on “Update BIOS.”

If you see the “Update BIOS” option, your Lenovo laptop has the Lenovo System Update feature. If you don’t see this option, your Laptop doesn’t have this feature, and you’ll need to install the BIOS updates manually.

Method 2: WinFlash

To use Winflash to install a BIOS update:

1. Download the most recent BIOS to your Windows desktop for easier usage. To locate and download the BIOS, follow these steps: Open the Lenovo support website (support.lenovo.com).
2. Enter the system machine type or product name. On the product page, click Drivers & Software. Filter by BIOS/UEFI, and choose the corresponding OS information.
3. Follow the instructions in the readme file to download and install the BIOS. Right-click on the BIOS flash package and select Run as administrator.
4. A self-extracting window will appear on Windows, and you should click the Install button. Then click on the Flash BIOS button. A caution screen will appear to notify users to connect the system’s power outlet and supply additional flash information.
5. Select the OK button. The BIOS update flashing program will automatically run. Please wait until the BIOS update flashing program has finished installation. When the BIOS update is completed, your computer reboots automatically.

Method 3: Update BIOS From Windows

Updating BIOS from Windows is simple and straight. Steps to update system BIOS in Lenovo Laptops:

1. Visit the official Lenovo website and download the BIOS update file.
2. Extract the downloaded file to a folder on your computer.
3. Double-click on the extracted BIOS file to launch the update process.
4. Follow the on-screen instructions to complete the BIOS update process.
5. Restart your computer and check if the BIOS update is successful.

These are the steps to update the system BIOS in Lenovo Laptops. Following these steps should help you update your BIOS successfully. In case you face any issues, please reach out to the Lenovo support team for assistance.

List Of Lenovo Laptops Vulnerable To The Flaws:

Lenovo has verified its Laptop modules and published the vulnerable models in its advisory report. Please don’t miss seeing the list from here. Click here for a complete list of all Lenovo Product Security Advisories.

We hope this post will help you know How to Fix The 3 New Vulnerabilities in Lenovo BIOS. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this. 

• Run Windows On Mac for Free
• BIOSConnect And HTTPS Boot Vulnerabilities
• How To Fix The 16 New LPE And ACE Vulnerabilities In HP BIOS
• How To Fix The BIOSConnect And HTTPS Boot Vulnerabilities Found On 129 Dell Models (30 Million Devices)?
• Fix the 16 New LPE and ACE Vulnerabilities in HP BIOS