Lenovo Notebook BIOS Vulnerabilities

Lenovo Notebook BIOS Vulnerabilities

Lenovo Notebook BIOS Vulnerabilities

Lenovo Security Advisory: LEN-91369

Potential Impact: Privilege escalation

Severity: Medium

Scope of Impact: Lenovo-specific

CVE Identifier: CVE-2022-1890, CVE-2022-1891, CVE-2022-1892

 

Summary Description:

The following vulnerabilities were reported in Lenovo Notebook BIOS.

CVE-2022-1890: A buffer overflow has been identified in the ReadyBootDxe driver in some Lenovo notebook products which may allow an attacker with local privileges to execute arbitrary code.

CVE-2022-1891: A buffer overflow has been identified in the SystemLoadDefaultDxe driver in some Lenovo notebook products which may allow an attacker with local privileges to execute arbitrary code.

CVE-2022-1892: A buffer overflow has been identified in the SystemBootManagerDxe driver in some Lenovo notebook products which may allow an attacker with local privileges to execute arbitrary code.

 

Mitigation Strategy for Customers (what you should do to protect yourself):

Update system firmware to the version (or newer) indicated for your model in the product Impact section.

 

Product Impact:

To download the version specified for your product below, follow these steps:

Navigate to the Drivers & Software support site for your product:

  1. Search for your product by name or machine type.
  2. Click Drivers & Software on the left menu panel.
  3. Click on Manual Update to browse by Component type.
  4. Compare the minimum fix version for your product from the applicable product table below with the latest version posted on the support site.

Lenovo also offers tools to assist with update management as an alternative to the manual steps described above. Refer to the following for additional help:

PC Products and Software: https://support.lenovo.com/us/en/solutions/ht504759

Server and Enterprise Software: https://support.lenovo.com/us/en/solutions/lnvo-lxcaupd and https://datacentersupport.lenovo.com/us/en/documents/lnvo-center

 

Click below links to view affected products:

Lenovo Notebook

 

Acknowledgement:

Lenovo thanks Martin Smolár from ESET for reporting these issues.

 

Revision History:

Revision Date Description
3 2023-09-28 Update Product Impact
2 2022-08-08 Update Product Impact
1 2022-07-12 Initial release

For a complete list of all Lenovo Product Security Advisories, click here.

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.

 

Product Impact:

Lenovo Notebook

Product Component CVE-2022-1890 CVE-2022-1891 CVE-2022-1892
100e 2nd Gen Notebook (Lenovo) (Type 82GJ) BIOS Update for Windows 10 (64-bit) - Lenovo 100e 2nd Gen (MT:82GJ), Lenovo 300e 2nd Gen (MT:82GK) Not Affected Not Affected FRCN23WW
100w Gen 3 Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - 100w Gen 3, 300w Gen 3 Not Affected Not Affected GACN38WW
13w Yoga (Type 82S1, 82S2) Laptop (Lenovo) BIOS Update Utility for Windows 11 (Version 21H2 or later), 10 (Version 21H2 or later) - Lenovo 13w Yoga (Type 82S1, 82S2) Not Affected Not Affected JACN31WW
14W Gen 2 Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Lenovo 14W Gen 2 Not Affected Not Affected H0CN21WW
300e 2nd Gen Notebook (Lenovo) (Type 82GK) BIOS Update for Windows 10 (64-bit) - Lenovo 100e 2nd Gen (MT:82GJ), Lenovo 300e 2nd Gen (MT:82GK) Not Affected Not Affected FRCN23WW
300w Gen 3 Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - 100w Gen 3, 300w Gen 3 Not Affected Not Affected GACN38WW
500w Gen 3 Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Lenovo 500w Gen 3 Not Affected Not Affected G6CN40WW
730S-13IML Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Yoga S730-13IML,ideapad 730S-13IML Not Affected Not Affected BRCN20WW
Flex 3-11ADA05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Flex 3-11ADA05 Not Affected Not Affected FPCN26WW
Flex 5-14ALC05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Flex 5 14ALC05, Flex 5 15ALC05 Not Affected Not Affected GJCN27WW
Flex 5-14ARE05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - Flex 5-14ARE05 Not Affected Not Affected EECN39WW
Flex 5-14IIL05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Flex 5-14IIL05, Flex 5-15IIL05 Not Affected Not Affected ECCN40WW
Flex 5-14ITL05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit), Windows 11 (64-bit) - Flex 5-14ITL05, Flex 5-15ITL05 Not Affected Not Affected FXCN38WW
Flex 5-15ALC05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Flex 5 14ALC05, Flex 5 15ALC05 Not Affected Not Affected GJCN27WW
Flex 5-15IIL05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Flex 5-14IIL05, Flex 5-15IIL05 Not Affected Not Affected ECCN40WW
Flex 5-15ITL05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit), Windows 11 (64-bit) - Flex 5-14ITL05, Flex 5-15ITL05 Not Affected Not Affected FXCN38WW
IdeaPad 1-11ADA05 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 1-11ADA05, ideapad 1-14ADA05 Not Affected Not Affected FQCN26WW
IdeaPad 1-11IGL05 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 1-11IGL05, ideapad 1-14IGL05 Not Affected Not Affected DWCN24WW
IdeaPad 1-14ADA05 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 1-11ADA05, ideapad 1-14ADA05 Not Affected Not Affected FQCN26WW
IdeaPad 1-14IGL05 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 1-11IGL05, ideapad 1-14IGL05 Not Affected Not Affected DWCN24WW
IdeaPad 3 15ADA05 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 3 14ADA05, IdeaPad 3 15ADA05, IdeaPad 3 17ADA05, V14-ADA, V15-ADA Not Affected Not Affected E8CN36WW
IdeaPad 3-14ADA05 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 3 14ADA05, IdeaPad 3 15ADA05, IdeaPad 3 17ADA05, V14-ADA, V15-ADA Not Affected Not Affected E8CN36WW
IdeaPad 3-14ADA6 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 3-14ADA6, IdeaPad 3-15ADA6, IdeaPad 3-17ADA6 Not Affected Not Affected HBCN24WW
IdeaPad 3-14ALC6 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 3-14ALC6, ideapad 3-15ALC6, ideapad 3-17ALC6, V14 G2-ALC, V15 G2-ALC Not Affected Not Affected GLCN48WW
IdeaPad 3-15ADA6 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 3-14ADA6, IdeaPad 3-15ADA6, IdeaPad 3-17ADA6 Not Affected Not Affected HBCN24WW
IdeaPad 3-15ALC6 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 3-14ALC6, ideapad 3-15ALC6, ideapad 3-17ALC6, V14 G2-ALC, V15 G2-ALC Not Affected Not Affected GLCN48WW
IdeaPad 3-17ADA05 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 3 14ADA05, IdeaPad 3 15ADA05, IdeaPad 3 17ADA05, V14-ADA, V15-ADA Not Affected Not Affected E8CN36WW
IdeaPad 3-17ADA6 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 3-14ADA6, IdeaPad 3-15ADA6, IdeaPad 3-17ADA6 Not Affected Not Affected HBCN24WW
IdeaPad 3-17ALC6 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 3-14ALC6, ideapad 3-15ALC6, ideapad 3-17ALC6, V14 G2-ALC, V15 G2-ALC Not Affected Not Affected GLCN48WW
IdeaPad 5 15ABA7 BIOS Update for Windows 11 (64-bit) - IdeaPad 5 15ABA7 Not Affected Not Affected KACN14WW
ideapad 5-15ALC05 Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 5-15ALC05 Not Affected Not Affected H2CN27WW
IdeaPad Flex 5 14ALC7 Laptop BIOS Update for Windows 11 (64-bit) - IdeaPad Flex 5 14ALC7, IdeaPad Flex 5 16ALC7 Not Affected Not Affected JCCN29WW
IdeaPad Flex 5 16ALC7 BIOS Update for Windows 11 (64-bit) - IdeaPad Flex 5 14ALC7, IdeaPad Flex 5 16ALC7 Not Affected Not Affected JCCN29WW
Legion S7-15ACH6 Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Legion S7-15ACH6 Not Affected Not Affected HACN37WW
Legion S7-15ARH5 Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) - Legion S7-15ARH5 Not Affected Not Affected G1CN27WW
Legion S7-15IMH5 Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) - Legion S7-15IMH5 Not Affected Not Affected FDCN40WW
S145-14API Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - S145-14API, S145-15API Not Affected Not Affected BUCN33WW
S145-14AST Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - S145-14AST, S145-15AST Not Affected Not Affected AYCN28WW
S145-15API Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - S145-14API, S145-15API Not Affected Not Affected BUCN33WW
S145-15AST Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - S145-14API, S145-15API Not Affected Not Affected BUCN33WW
S145-15AST Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - S145-14AST, S145-15AST Not Affected Not Affected AYCN28WW
S540-13API Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - S540-13API Not Affected Not Affected CXCN36WW
S940-14IIL Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - Yoga S940-14IIL, ideapad S940-14IIL Not Affected Not Affected BQCN34WW
Slim 1-11AST-05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Slim 1-11AST-05, Slim 1-14AST-05 Not Affected Not Affected CWCN25WW
Slim 1-14AST-05 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Slim 1-11AST-05, Slim 1-14AST-05 Not Affected Not Affected CWCN25WW
ThinkBook 13s G2 ARE Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ThinkBook 13s G2 ARE Not Affected Not Affected FVCN24WW
ThinkBook 13s G2 ITL Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ThinkBook 13s G2 ITL, ThinkBook 14s G2 ITL Not Affected Not Affected F9CN50WW
ThinkBook 13s G3 ACN Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ThinkBook 13s G3 ACN Not Affected Not Affected GMCN29WW
ThinkBook 13s-IML Laptop BIOS Update for Windows 10 (64-bit) - ThinkBook 13s-IML, ThinkBook 14s-IML Not Affected Not Affected CQCN37WW
ThinkBook 14-IIL Laptop BIOS Update for Windows 10 (64-bit) - ThinkBook 14-IIL, ThinkBook 15-IIL DJCN28WW DJCN28WW DJCN28WW
ThinkBook 14-IML Laptop BIOS Update for Windows 10 (64-bit) - ThinkBook 14-IML, ThinkBook 15-IML CJCN38WW CJCN38WW CJCN38WW
ThinkBook 14p G2 ACH Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ThinkBook 14p G2 ACH Not Affected Not Affected GWCN41WW
ThinkBook 14s G2 ITL Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ThinkBook 13s G2 ITL, ThinkBook 14s G2 ITL Not Affected Not Affected F9CN50WW
ThinkBook 14s-IML Laptop BIOS Update for Windows 10 (64-bit) - ThinkBook 13s-IML, ThinkBook 14s-IML Not Affected Not Affected CQCN37WW
ThinkBook 15-IIL Laptop BIOS Update for Windows 10 (64-bit) - ThinkBook 14-IIL, ThinkBook 15-IIL DJCN28WW DJCN28WW DJCN28WW
ThinkBook 15-IML Laptop BIOS Update for Windows 10 (64-bit) - ThinkBook 14-IML, ThinkBook 15-IML CJCN38WW CJCN38WW CJCN38WW
ThinkBook 16p G2 ACH Laptop BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ThinkBook 16p G2 ACH Not Affected Not Affected GXCN42WW
V130-15IKB Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) - V130-15IKB Not Affected Not Affected 8VCN31WW
V14 G2-ALC Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 3-14ALC6, ideapad 3-15ALC6, ideapad 3-17ALC6, V14 G2-ALC, V15 G2-ALC Not Affected Not Affected GLCN48WW
V14-ADA Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 3 14ADA05, IdeaPad 3 15ADA05, IdeaPad 3 17ADA05, V14-ADA, V15-ADA Not Affected Not Affected E8CN36WW
V15 G2-ALC Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - ideapad 3-14ALC6, ideapad 3-15ALC6, ideapad 3-17ALC6, V14 G2-ALC, V15 G2-ALC Not Affected Not Affected GLCN48WW
V15-ADA Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - IdeaPad 3 14ADA05, IdeaPad 3 15ADA05, IdeaPad 3 17ADA05, V14-ADA, V15-ADA Not Affected Not Affected E8CN36WW
Yoga 9-15IMH5 Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Yoga 9-15IMH5 Not Affected Not Affected EPCN28WW
Yoga C640-13IML Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) - Yoga C640-13IML, Yoga C640-13IML LTE CHCN28WW CHCN28WW CHCN28WW
Yoga C640-13IML LTE Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) - Yoga C640-13IML, Yoga C640-13IML LTE CHCN28WW CHCN28WW CHCN28WW
Yoga C940-15IRH Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Yoga C940-15IRH Not Affected Not Affected BSCN37WW
Yoga S730-13IML Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Yoga S730-13IML,ideapad 730S-13IML Not Affected Not Affected BRCN20WW
Yoga S940-14IIL Laptop (Lenovo) BIOS Update for Windows 10 (64-bit) - Yoga S940-14IIL, ideapad S940-14IIL Not Affected Not Affected BQCN34WW
Yoga Slim 7 Pro-14ACH5 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Yoga Slim 7 Pro-14ACH5, Yoga Slim 7 Pro-14ACH5 O Not Affected Not Affected GZCN29WW
Yoga Slim 7 Pro-14ACH5 O Laptop (ideapad) BIOS Update for Windows 10 (64-bit) and Windows 11 (64-bit) - Yoga Slim 7 Pro-14ACH5, Yoga Slim 7 Pro-14ACH5 O Not Affected Not Affected GZCN29WW
Yoga Slim 7 Pro-14ARH5 Laptop (ideapad) BIOS Update for Windows 10 (64-bit) - Yoga Slim 7 Pro-14ARH5 Not Affected Not Affected G7CN24WW

Alias Id:LEN-91369
Document ID:PS500500
Original Publish Date:07/08/2022
Last Modified Date:09/28/2023