© 2022 CyberNews - Latest tech news,
product reviews, and analyses.

If you purchase via links on our site, we may receive affiliate commissions.

Over 70 Lenovo notebook models vulnerable to ACE attacks – ESET

Buffer overflow vulnerabilities UEFI firmware could allow attackers to carry out arbitrary code execution (ACE) attacks and disable essential security features, researchers claim.

Researchers at cybersecurity company ESET warned that over 70 models of Lenovo notebook devices are fitted with vulnerable UEFI firmware.

UEFI, short for Unified Extensible Firmware Interface, is used to kickstart the hardware of a computer before loading the operating system.

“The vulnerabilities can be exploited to achieve arbitrary code execution in the early phases of the platform boot, possibly allowing the attackers to hijack the OS execution flow and disable some important security features,” ESET claims.

Several Lenovo laptops such as ThinkBook 13s-IML, ThinkBook 14-IIL, and ThinkBook 14-IML are affected by all three vulnerabilities. While others, like variations of Lenovo’s Yoga, are affected by one or two of the newly discovered vulnerabilities.

The attackers could exploit the vulnerabilities by creating a non-volatile random-access memory (NVRAM) variable and causing buffer overflow of the data buffer. A buffer overflow occurs when a program is given too much data.

The vulnerabilities, CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892, were assigned a ‘medium’ severity rate. According to an advisory from Lenovo, the issues in the firmware could lead to privilege escalation attacks.

Lenovo recommends updating the firmware. Detailed instructions on installing the updates and a complete list of affected models are included in Lenovo’s advisory.

More from Cybernews:

Click rate for vishing scams triple that of phishing

Threat actors impersonated Angela Merkel to hack Christine Lagarde

Amazon launches cancer vaccine trial

Microsoft records a phishing campaign targeting over 10k organizations

Cyber-college falls for password-hacking scam

Subscribe to our newsletter

Leave a Reply

Your email address will not be published. Required fields are marked