Lenovo Patches Alarming UEFI Exploits Affecting Over 100 Laptops, Update ASAP
We'll come clean up front: it's true that these security exploits require local access, and due to that fact, the urgent need to update might be a bit overstated. In this case, though, the excitement is less about the breadth of the vulnerabilities and instead the severity.
If you're confused, Lenovo published a document on April 18th warning its customers of three severe vulnerabilities in its system firmware across a wide variety of its consumer laptops. (None of the ThinkPad or ThinkBook models are affected.) These vulnerabilities could allow a local attacker to modify the firmware, allowing them to embed malware directly into the system board's UEFI eprom.
This is terrible for all kinds of reasons. Malware running at the UEFI firmware level is extremely difficult to detect from the operating system, and it has full access to everything on the system. One of the other vulnerabilities requires local access and elevated privileges, but it could be used to escape virtualization sandboxes, which is also troubling.
Fortunately, just four days later, Lenovo has patches available for most of the affected systems. You can head over to Lenovo's site to check your specific model to see if you're affected. A simple BIOS update is all that's required to fix the issues.