Do you have a Lenovo laptop?
If you own a Lenovo laptop, be aware that researchers at ESET have recently discovered a trio of bugs reported to Lenovo that could allow an attacker to disable security features and hijack your operating system.
The issues are tracked as CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892 and are all classed as medium severity level.
The first of these is an issue in the ReadcyBootDxe driver used in some of Lenovo's products, while the other two are overflow bugs in the SystemLoadDefaultDxe driver.
Unfortunately, the issue is quite widespread, as the SystemLoadDefaultDxe driver is used in more than 70 different Lenovo models. That includes everything in the IdeaPad, Flex, ThinkBook, V14, V15, V130, Slim, S145, S540, S940, and Yoga product lines.
The company has issued a formal advisory regarding the issue and has a complete listing of all their products impacted by these flaws on their website.
NOTE: Lenovo "How to Fix" notes
ESET had this to say about their recent discovery
"These vulnerabilities were caused by insufficient validation of DataSize parameter passed to the UEFI Runtime Services function GetVariable. An attacker could create a specially crafted NVRAM variable, causing buffer overflow of the Data buffer in the second GetVariable call."
If there's a silver lining to be found here, it lies in the fact that exploiting these flaws is not a trivial task and requires a skillset that is likely beyond a great many of the world's hackers.
That does not mean that you are safe. You are very much at risk. The good news though is that at least a casual or relatively inexperienced hacker will not be able to easily exploit these weaknesses. They're still well worth keeping on your company's radar, however.
My perspective
One final note to be aware of is that if you're having trouble determining whether your Lenovo is on the vulnerable list, the company has published a website that auto-detects for the vulnerability. It is hands down the fastest way to find out for sure. Good luck out there!
Follow the link above, and Bob's your uncle,
you can find out if you are buggy
By Denis Wilson
Thanks for reading this post. I always take into mind that your time and attention are precious. And these posts need to be timely, to the point, and short.
For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, Facebook, and Twitter.
I am also a published author and speaker on cloud computing, work-at-home, and cybersecurity. I work extensively with business and professional associations to provide free small business technology education programs.
Contact me if you would like me to speak to your association
