If you own a Lenovo laptop, be aware that researchers at ESET have recently discovered a trio of bugs reported to Lenovo that could allow an attacker to disable security features and hijack your operating system.
The issues are tracked as CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892 and are all classed as medium severity level.
The first of these is an issue in the ReadcyBootDxe driver used in some of Lenovo's products, while the other two are overflow bugs in the SystemLoadDefaultDxe driver.
Unfortunately, the issue is quite widespread, as the SystemLoadDefaultDxe driver is used in more than 70 different Lenovo models. That includes everything in the IdeaPad, Flex, ThinkBook, V14, V15, V130, Slim, S145, S540, S940, and Yoga product lines.
The company has issued a formal advisory regarding the issue and has a complete listing of all their products impacted by these flaws on their website.
ESET had this to say about their recent discovery:
"These vulnerabilities were caused by insufficient validation of DataSize parameter passed to the UEFI Runtime Services function GetVariable. An attacker could create a specially crafted NVRAM variable, causing buffer overflow of the Data buffer in the second GetVariable call."
If there's a silver lining to be found here, it lies in the fact that exploiting these flaws is not a trivial task and requires a skillset that is likely beyond a great many of the world's hackers.
That does not mean that you are safe. You are very much at risk. The good news though is that at least a casual or relatively inexperienced hacker will not be able to easily exploit these weaknesses. They're still well worth keeping on your company's radar, however.
One final note to be aware of is that if you're having trouble determining whether your Lenovo is on the vulnerable list, the company has published a website that auto-detects for the vulnerability. It is hands down the fastest way to find out for sure. Good luck out there!
If this tip helps and you would like to donate click on the button. Thanks In Advance
________________________________________________________________________________________________________
"Fortune Favors Who Value Time over Money!"
"TeQ I.Q. was the 1st IT Company to Deliver Cloud Solutions since 2003"
Tech issues taking up your Time?
"TeQ I.Q. Makes Your Technology Simple and Easy"
Do you have Tech Frustrations like your Computer, Internet, Phone, Cellphone, Camera, TV, Car?
"We Take Away Your Tech Frustrations and Give You the Free Time You Deserve!"
Call Robert to ask all your Technology questions.
We are giving a Free in Person TeQ Seminar at our office in La Mesa every Wednesday from 12pm-1pm and a Free TeQ Support Q&A from 1pm-2pm. Go to https://www.teqiq.com/events for our upcoming Events and https://www.teqiq.com/seminars for info on each Seminar.
For Free Consultation Call Now Robert Black at (619) 255-4180 or visit our website https://www.teqiq.com/
Chase Bank and Others Trust TeQ I.Q. with their IT and TeQnology so can you!
