SMM "Incursion" Attack
SMM "Incursion" Attack
SMM "Incursion" Attack
Lenovo Security Advisory: LEN-2015-002
Potential Impact: Execute arbitrary code, Bypass Secure Boot, Denial of Service, Escalation of Privilege
Severity: Medium
Summary:
Some BIOS implementations permit unsafe System Management Mode (SMM) function calls to memory locations outside of System Management RAM (SMRAM). An attacker can exploit these calls to bypass Secure Boot, read/write system memory, or overwrite, modify, or corrupt the BIOS.
Description:
SMM is the most privileged execution mode of the x86 processor, and only SMM should normally be able to access SMRAM. Some BIOS implementations permit unsafe SMM function calls to memory locations outside of SMRAM, allowing an attacker with logical access to a computer to execute arbitrary code in the highly privileged SMM context. Doing so enables an attacker to bypass Secure Boot or read/write all system memory.
Additionally, an attacker can use this mechanism to overwrite, modify, or corrupt the BIOS on computers that do not use protected range registers as a BIOS write protection mechanism.
Product Impact:
Click to expand for more info
ThinkStation
| System | Status |
|---|---|
| ThinkStation C30 (type 1095, 1096, 1097) |
Not Affected |
| ThinkStation C30 (type 1136, 1137) |
Not Affected |
| ThinkStation D30 (type 4223, 4228, 4229) |
Not Affected |
| ThinkStation D30 (type 4353, 4354) |
Not Affected |
| ThinkStation E31 | Not Affected |
| ThinkStation E32 | Not Affected |
| ThinkStation P300 | Not Affected |
| ThinkStation P500 | Not Affected |
| ThinkStation P700 | Not Affected |
| ThinkStation P900 | Not Affected |
| ThinkStation S30 (type 0567, 0568, 0569, 0606) | Not Affected |
| ThinkStation S30 (type 4351, 4352) | Not Affected |
ThinkServer & Storage
| System | Status |
|---|---|
| ThinkServer RD330 | Not affected |
| ThinkServer RD340 | Not affected |
| ThinkServer RD350 | Not affected |
| ThinkServer RD430 | Not affected |
| ThinkServer RD440 | Not affected |
| ThinkServer RD450 | Not affected |
| ThinkServer RD530 | Not affected |
| ThinkServer RD540 | Not affected |
| ThinkServer RD550 | Not affected |
| ThinkServer RD630 | Not affected |
| ThinkServer RD640 | Not affected |
| ThinkServer RD650 | Not affected |
| ThinkServer RS140 | Not affected |
| ThinkServer TD340 | Not affected |
| ThinkServer TD350 | Not affected |
| ThinkServer TS130 | Not affected |
| ThinkServer TS140 | Not affected |
| ThinkServer TS430 | Not affected |
| ThinkServer TS440 | Not affected |
| ThinkServer RQ940 | Not affected |
ThinkPad
ThinkCentre
| System | Status |
|---|---|
| ThinkCentre E73z | Not Affected |
| ThinkCentre E93 | Not Affected |
| ThinkCentre E93z | Not Affected |
| ThinkCentre Edge 62z | Not Affected |
| ThinkCentre Edge 63z | Not Affected |
| ThinkCentre Edge 72 | Not Affected |
| ThinkCentre Edge 72z | Not Affected |
| ThinkCentre M62z | Not Affected |
| ThinkCentre M72e | Not Affected |
| ThinkCentre M72e | Not Affected |
| ThinkCentre M72z | Not Affected |
| ThinkCentre M73 | Not Affected |
| ThinkCentre M73 Tiny | Not Affected |
| ThinkCentre M73z | Not Affected |
| ThinkCentre M78 | Not Affected |
| ThinkCentre M78 | Not Affected |
| ThinkCentre M79 | Not Affected |
| ThinkCentre M83/M83z | Not Affected |
| ThinkCentre M92 | Not Affected |
| ThinkCentre M92p | Not Affected |
| ThinkCentre M93M93z | Not Affected |
Software
| Application | Status |
|---|---|
| Delopy Manager | Not affected |
| Diagnostic | Not affected |
| Easy Manager | Not affected |
| Easy Updater | Not affected |
| Energy manager | Not affected |
| OSPUT | Not affected |
| Partner Pack | Not affected |
| Power Planner | Not affected |
| TSMCLI | Not affected |
Lenovo Notebook
| System | Status | Minimum version including Fix |
Link |
|---|---|---|---|
| B40-30/B50-30/E40-30 | Not Affected | − | − |
| B40-45 / B50-45 | Not Affected | − | − |
| B40-70/B50-70/E40-70/E50-70 | Not Affected | − | − |
| B490 | Affected | H9ET90WW | http://support.lenovo.com/us/en/downloads/DS032260 |
| Colombia Yoga 2 13 | Not Affected | − | − |
| E10-30 | Affected | A5CN36WW(V3.7) | http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-e-series-laptops/lenovo-e10-30/downloads/DS100550 |
| Flex 10 | Affected | 93CN57WW(V9.7) | http://support.lenovo.com/us/en/products/laptops-and-netbooks/flex-series/flex-10-notebook-lenovo |
| Flex 2 14/Flex 2 15 (Haswell) | Affected | A0CN36WW | http://support.lenovo.com/us/en/downloads/DS101193 |
| Flex 2 14D/Flex 2 15D | Affected | 9FCN25WW | http://support.lenovo.com/us/en/downloads/DS101002 |
| Flex 2 Pro-15 (Broadwell) | Affected | A9CN47WW | http://support.lenovo.com/us/en/downloads/DS101359 |
| Flex 2 Pro-15 (Haswell) | Affected | B9CN17WW | http://support.lenovo.com/us/en/downloads/DS101359 |
| Flex 3 11 | Not Affected | − | − |
| G40-30/G50-30 | Not Affected | − | − |
| G40-45/G50-45 | Not Affected | − | − |
| G40-70/G50-70/G70-70 | Not Affected | − | − |
| G40-75/G50-75 | Not Affected | − | − |
| G40-80/G50-80/G70-80 | Not Affected | − | − |
| G410/G510 | Not Affected | − | − |
| G410s/G510s | Not Affected | − | − |
| Hiking | Not Affected | − | − |
| K20-80 | Affected | ADCN37WW | Contact your support representative |
| K2450 | Affected | J2ET40WW | http://support.lenovo.com/us/en/downloads/DS100835 |
| K4450 | Affected | J8ET43WW | http://support.lenovo.com/us/en/downloads/DS101630 |
| M50-70 | Affected | B3CN23WW | http://support.lenovo.com/us/en/downloads/DS101348 |
| Miix 2 11 | Affected | 97CN43WW | http://support.lenovo.com/us/en/downloads/DS101276 |
| Miix 3-1030 | Affected | B4CN25WW | http://support.lenovo.com/us/en/products/tablets/miix-series/miix-3-1030-tablet-lenovo |
| S20-30 | Affected | ACCN22WW(V2.0) | http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-s-series-laptops/lenovo-s20-30-notebook |
| S310/S410 | Not Affected | − | − |
| S41-70 HSW/BDW | Affected | BDCN31WW | http://support.lenovo.com/us/en/downloads/DS102775 |
| S435/M40-35(YC) Beema | Not Affected | − | − |
| Y40-70 | Not Affected | − | − |
| Y410/510 | Not Affected | − | − |
| Y410P/510P (IdeaPad) | Not Affected | − | − |
| Y430P (IdeaPad) | Not Affected | − | − |
| Y50-70/Y70-70 | Not Affected | − | − |
| Yoga 2 11 (Baytrail-M) | Not Affected | − | − |
| Yoga 2 11 (Haswell) | Not Affected | − | − |
| Yoga 2 Pro | Not Affected | − | − |
| Yoga 3 14 | Affected | BACN33WW | http://support.lenovo.com/us/en/downloads/DS102769 |
| Yoga 3 Pro | Not Affected | − | − |
| Z40-70/Z50-70/Z70-70 | Not Affected | − | − |
| Z40-75/Z50-75 | Affected | A4CN37WW | http://support.lenovo.com/us/en/downloads/DS100825 |
| Z40-80/Z50-80/Z70-80 | Not Affected | − | − |
Lenovo Desktop
| System | Status |
|---|---|
| 63 Desktop | Not Affected |
| A540 All In One (Broadwell) | Not Affected |
| A740 All-In-One - BDW | Not Affected |
| B40-30 All-In-One | Not Affected |
| B40-30 Touch All-In-One | Not Affected |
| B50-30 All-In-One | Not Affected |
| B50-30 Touch All-In-One | Not Affected |
| B5035 | Not Affected |
| B50-35 All-In-One | Not Affected |
| C20-05 All-In-One | Not Affected |
| C20-30 All-In-One | Not Affected |
| C260 All--In-One | Not Affected |
| C260 Touch All-In-One | Not Affected |
| C360 All-In-One | Not Affected |
| C365 All-In-One | Not Affected |
| C40-05 All-In-One | Not Affected |
| C40-30 All-In-One | Not Affected |
| C460 All-In-One | Not Affected |
| C470 All-In-One | Not Affected |
| C50-30 All-In-One | Not Affected |
| C5030-non-Touch | Not Affected |
| C560 All-In-One | Not Affected |
| E50-00 Deskop | Not Affected |
| ErazerX700 Desktop | Not Affected |
| H30-00 Desktop | Not Affected |
| H30-05 Desktop | Not Affected |
| H30-50 Desktop | Not Affected |
| H50-00 Desktop | Not Affected |
| H50-05 Desktop | Not Affected |
| H50-30g Desktop | Not Affected |
| H50-50 Desktop | Not Affected |
| H530 Desktop | Not Affected |
| H530s Desktop | Not Affected |
| Horizon 2 27 Table PC | Not Affected |
| Horizon2e Table PC | Not Affected |
| Horizon2s Table PC | Not Affected |
| M4350 Desktop | Not Affected |
| S40-40 All-In-One | Not Affected |
Lenovo EMC
| System | Status | Minimum version including Fix |
Link |
|---|---|---|---|
| LenovoEMC px12-400r | Not Affected | − | − |
| LenovoEMC EZ Media & Backup (hm3) | Not Affected | − | − |
| LenovoEMC ix2 (inc DL) | Not Affected | − | − |
| LenovoEMC ix4-300d (inc DL) | Not Affected | − | − |
| LenovoEMC px2-300d (inc NVR) | Not Affected | − | − |
| LenovoEMC px4-300d (inc NVR) | Not Affected | − | − |
| LenovoEMC px4-300r | Not Affected | − | − |
| LenovoEMC px4-400d | Not Affected | − | − |
| LenovoEMC px4-400d NVR | Not Affected | − | − |
| LenovoEMC px4-400r | Not Affected | − | − |
| LenovoEMC px6-300d | Not Affected | − | − |
| LenovoEMC px12-400r | Not Affected | − | − |
| LenovoEMC px12-450r | Not Affected | − | − |
| LenovoEMC ix12-300r | Not Affected | − | − |
| LenovoEMC px12-350r | Not Affected | − | − |
| LenovoEMC Home Media Cloud Edition (hm2) | Not Affected | − | − |
| LenovoEMC ix2-200 Cloud Edition | Not Affected | − | − |
| LenovoEMC ix4-200d Cloud Edition | Not Affected | − | − |
| LenovoEMC Iconnect | Not Affected | − | − |
| LenovoEMC ix2-200 | Not Affected | − | − |
| LenovoEMC ix4-200d | Not Affected | − | − |
| LenovoEMC ix4-200d (2.1.x firmware) | Not Affected | − | − |
| LenovoEMC ix2 (1 bay) | Not Affected | − | − |
| LenovoEMC ix4-100 | Not Affected | − | − |
| LenovoEMC ix4-200r (2.0.x firmware) | Not Affected | − | − |
Acknowledgements:
Thanks to Corey Kallenberg of LegbaCore for reporting this vulnerability.
Other information and references:
- CERT Vulnerability Note: VU#631788
- CVE ID: CVE-2015-0949
- Presentation: http://www.legbacore.com/Research_files/HowManyMillionBIOSWouldYouLikeToInfect_Full2.pdf
Revision History:
|
Revision |
Date |
Description |
| 1.11 | 30 May 2016 | Publish additional fixes |
| 1.10 | 16 Mar 2016 | Publish additional fixes |
| 1.9 | 16 Dec 2015 | Publish additional fixes |
| 1.8 | 19 Nov 2015 | Publish additional fixes |
| 1.7 | 11 Nov 2015 | Publish additional fixes |
| 1.6 | 28 Oct 2015 | Publish additional fixes |
| 1.5 | 19 Oct 2015 | Publish additional fixes |
| 1.4 | 02 Oct 2015 | Publish additional fixes |
| 1.3 | 23 Sep 2015 | Publish additional fixes |
| 1.2 | 29 Jun 2015 | Publish additional fixes |
| 1.1 | 17 May 2015 | Publish additional fixes |
| 1.0 | 10 Apr 2015 | Initial release |
Was this information helpful?
Your feedback helps to improve the overall experience
Alias Id:SMM_ATTACK
Document ID:PS500057
Original Publish Date:06/27/2016
Last Modified Date:07/22/2016
