CVE-2022-3431
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.21% probability · 11th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-276
- Affected
- lenovo/ideapad creator 5-16ach6 firmware · lenovo/ideapad 5 pro-16ihu6 firmware · lenovo/ideapad 5 pro-16ach6 firmware · lenovo/yoga slim 7-13itl05 firmware · lenovo/yoga slim 7-13acn05 firmware · lenovo/yoga slim 7 pro 16arh7 firmware · lenovo/yoga slim 7 pro 16ach6 firmware · lenovo/yoga slim 7 carbon 13itl5 firmware · lenovo/yoga duet 7-13itl6-lte firmware · lenovo/yoga duet 7-13itl6 firmware · lenovo/yoga duet 7-13iml05 firmware · lenovo/thinkbook plus g3 iap firmware · lenovo/thinkbook plus g2 itg firmware · lenovo/thinkbook 16p nx arh firmware · lenovo/thinkbook 16 g4\+ iap firmware · lenovo/thinkbook 16 g4\+ ara firmware · lenovo/thinkbook 14 g4\+ iap firmware · lenovo/thinkbook 14 g4\+ ara firmware · lenovo/thinkbook 13x itg firmware · lenovo/ideapad slim 7 pro 16ach6 firmware · +5 more
- Source
- psirt@lenovo.com
References
- https://support.lenovo.com/us/en/product_security/LEN-94952Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-94952Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.