Lenovo Patches Alarming UEFI Exploits Affecting Over 100 Laptops, Update ASAP

We'll come clean up front: it's true that these security exploits require local access, and due to that fact, the urgent need to update might be a bit overstated. In this case, though, the excitement is less about the breadth of the vulnerabilities and instead the severity.

This is terrible for all kinds of reasons. Malware running at the UEFI firmware level is extremely difficult to detect from the operating system, and it has full access to everything on the system. One of the other vulnerabilities requires local access and elevated privileges, but it could be used to escape virtualization sandboxes, which is also troubling.

Fortunately, just four days later, Lenovo has patches available for most of the affected systems. You can head over to Lenovo's site to check your specific model to see if you're affected. A simple BIOS update is all that's required to fix the issues.