LENOVO DRIVER UPDATE DRIVERS
LENOVO DRIVER UPDATE FULL

LENOVO DRIVER UPDATE FULL

CVE-2021-3972: A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.ДЄ full list of Lenovo notebook modelsВ affected by each of the three vulnerabilities is available here.

CVE-2021-3971: A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.

A security advisory from Lenovo describes the vulnerabilities like this:

LENOVO DRIVER UPDATE DRIVERS

Researchers at ESET warn that the two UEFI-related vulnerabilities ( CVE-2021-3971 and CVE-2021-3972) can be used by attackers to вЂњdeploy and successfully execute SPI flash or ESP implants.вЂќД«oth UEFI-related security issues in Lenovo products result from introducing into production two UEFI firmware drivers - aptly named SecureBackDoor and SecureBackDoorPeim - that are used only during manufacturing process.

They affect more than 100 consumer laptop models, including IdeaPad 3, Legion 5 Pro-16ACH6 H, and Yoga Slim 9-14ITL05, which likely translates to millions of users with vulnerable devices. Successful exploitation of a third one, identified as CVE-2021-3970, could allow a local attacker to execute arbitrary code with elevated privileges.ДЄll three vulnerabilities were discovered by ESET researchers and reported responsibly to Lenovo in October last year. Lenovo has published a security advisory on vulnerabilities that impact its Unified Extensible Firmware Interface (UEFI) loaded on at least 100 of its laptop models.ДЄ total of three security issues were discovered, two of them allowing an attacker to disable the protection for the SPI flash memory chip where the UEFI firmware is stored and to turn off the UEFI Secure Boot feature, which ensures the system loads at boot time only code trusted by the Original Equipment Manufacturer (OEM).

Lenovo driver update