Vulnerability-Lookup

BDU:2023-02906

Vulnerability from fstec - Published: 23.01.2023

Title

Уязвимость драйвера настройки WMI микропрограммного обеспечения ноутбуков Lenovo, позволяющая нарушителю изменять параметры безопасной загрузки через переменную NVRAM

Description

Уязвимость драйвера настройки WMI микропрограммного обеспечения ноутбуков Lenovo связана с ошибками использования стандартных разрешений. Эксплуатация уязвимости может позволить нарушителю изменять параметры безопасной загрузки через переменную NVRAM

Severity ?


                    
                      AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vendor

Lenovo Group Limited

Software Name

ideapad D330-10IGM, IdeaPad 5 Pro 16ARH7, IdeaPad 5 Pro 16IAH7, IdeaPad Duet 3 10IGL5, Slim 7 16ARH7, ideapad Slim 7-14ARE05, ideapad Slim 7-14IIL05, ideapad Slim 7-14ITL05, ideapad Slim 7-15IIL05, ideapad Slim 7-15IMH05, ideapad Slim 7-15ITL05, ThinkBook 13x ITG, ThinkBook 14 G2 ARE Laptop, ThinkBook 14 G3 ITL, ThinkBook 14 G3 ACL, ThinkBook 14 G4 ABA Laptop, ThinkBook 14 G4+ ARA, ThinkBook 14 G4+ IAP Laptop, ThinkBook 14p G3 ARH, ThinkBook 14s Yoga ITL, ThinkBook 15 G2 ARE Laptop, ThinkBook 15 G2 ITL Laptop, ThinkBook 15 G3 ACL, ThinkBook 15 G3 ITL Laptop, ThinkBook 15 G4 ABA Laptop, ThinkBook 15P G2 ITH, ThinkBook 16 G4+ ARA, ThinkBook 16 G4+ IAP Laptop, ThinkBook 16p G3 ARH, ThinkBook 16p NX ARH, ThinkBook Plus G2 ITG, ThinkBook Plus G3 IAP, Yoga Creator 7-15IMH05, Yoga Duet 7-13IML05, Yoga Duet 7-13ITL6, Yoga Duet 7-13ITL6-LTE, Yoga Slim 7 Pro 16ARH7, Yoga Slim 7-14ARE05, Yoga Slim 7-14IIL05, Yoga Slim 7-14ITL05, Yoga Slim 7-15IIL05, Yoga Slim 7-15ITL05

Software Version

до G0CN11WW (ideapad D330-10IGM), до J4CN33WW (IdeaPad 5 Pro 16ARH7), до J5CN27WW (IdeaPad 5 Pro 16IAH7), до EQCN37WW (IdeaPad Duet 3 10IGL5), до KLCN15WW (Slim 7 16ARH7), до DMCN43WW (ideapad Slim 7-14ARE05), до DHCN35WW (ideapad Slim 7-14IIL05), до FBCN29WW (ideapad Slim 7-14ITL05), до DHCN35WW (ideapad Slim 7-15IIL05), до DNCN32WW (ideapad Slim 7-15IMH05), до FBCN29WW (ideapad Slim 7-15ITL05), до HLCN30WW (ThinkBook 13x ITG), до FACN33WW (ThinkBook 14 G2 ARE Laptop), до F8CN52WW (ThinkBook 14 G3 ITL), до GQCN35WW_HFCN30WW (ThinkBook 14 G3 ACL), до HRCN13WW (ThinkBook 14 G3 ITL), до JPCN20WW (ThinkBook 14 G4 ABA Laptop), до J6CN40WW (ThinkBook 14 G4+ ARA), до HYCN40WW (ThinkBook 14 G4+ IAP Laptop), до K4CN31WW (ThinkBook 14p G3 ARH), до FNCN40WW (ThinkBook 14s Yoga ITL), до FACN33WW (ThinkBook 15 G2 ARE Laptop), до F8CN52WW (ThinkBook 15 G2 ITL Laptop), до GQCN35WW_HFCN30WW (ThinkBook 15 G3 ACL), до HRCN13WW (ThinkBook 15 G3 ITL Laptop), до JPCN20WW (ThinkBook 15 G4 ABA Laptop), до HJCN31WW (ThinkBook 15P G2 ITH), до J6CN40WW (ThinkBook 16 G4+ ARA), до HYCN40WW (ThinkBook 16 G4+ IAP Laptop), до KCCN31WW (ThinkBook 16p G3 ARH), до KJCN27WW (ThinkBook 16p NX ARH), до GYCN31WW (ThinkBook Plus G2 ITG), до K6CN29WW (ThinkBook Plus G3 IAP), до DNCN32WW (Yoga Creator 7-15IMH05), до ERCN30WW (Yoga Duet 7-13IML05), до GPCN24WW (Yoga Duet 7-13ITL6), до GPCN24WW (Yoga Duet 7-13ITL6-LTE), до KLCN15WW (Yoga Slim 7 Pro 16ARH7), до DMCN43WW (Yoga Slim 7-14ARE05), до DHCN35WW (Yoga Slim 7-14IIL05), до FBCN29WW (Yoga Slim 7-14ITL05), до DHCN35WW (Yoga Slim 7-15IIL05), до FBCN29WW (Yoga Slim 7-15ITL05)

Possible Mitigations

Установка обновлений из доверенных источников. В связи со сложившейся обстановкой и введенными санкциями против Российской Федерации рекомендуется устанавливать обновления программного обеспечения только после оценки всех сопутствующих рисков. Компенсирующие меры: - использование средств доверенной загрузки. Использование рекомендаций производителя: https://support.lenovo.com/us/en/product_security/ps500528-lenovo-notebook-bios-vulnerabilities

Reference

https://support.lenovo.com/us/en/product_security/LEN-94952

CWE

CWE-276

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Lenovo Group Limited",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e G0CN11WW (ideapad D330-10IGM), \u0434\u043e J4CN33WW (IdeaPad 5 Pro 16ARH7), \u0434\u043e J5CN27WW (IdeaPad 5 Pro 16IAH7), \u0434\u043e EQCN37WW (IdeaPad Duet 3 10IGL5), \u0434\u043e KLCN15WW (Slim 7 16ARH7), \u0434\u043e DMCN43WW (ideapad Slim 7-14ARE05), \u0434\u043e DHCN35WW (ideapad Slim 7-14IIL05), \u0434\u043e FBCN29WW (ideapad Slim 7-14ITL05), \u0434\u043e DHCN35WW (ideapad Slim 7-15IIL05), \u0434\u043e DNCN32WW (ideapad Slim 7-15IMH05), \u0434\u043e FBCN29WW (ideapad Slim 7-15ITL05), \u0434\u043e HLCN30WW (ThinkBook 13x ITG), \u0434\u043e FACN33WW (ThinkBook 14 G2 ARE Laptop), \u0434\u043e F8CN52WW (ThinkBook 14 G3 ITL), \u0434\u043e GQCN35WW_HFCN30WW (ThinkBook 14 G3 ACL), \u0434\u043e HRCN13WW (ThinkBook 14 G3 ITL), \u0434\u043e JPCN20WW (ThinkBook 14 G4 ABA Laptop), \u0434\u043e J6CN40WW (ThinkBook 14 G4+ ARA), \u0434\u043e HYCN40WW (ThinkBook 14 G4+ IAP Laptop), \u0434\u043e K4CN31WW (ThinkBook 14p G3 ARH), \u0434\u043e FNCN40WW (ThinkBook 14s Yoga ITL), \u0434\u043e FACN33WW (ThinkBook 15 G2 ARE Laptop), \u0434\u043e F8CN52WW (ThinkBook 15 G2 ITL Laptop), \u0434\u043e GQCN35WW_HFCN30WW (ThinkBook 15 G3 ACL), \u0434\u043e HRCN13WW (ThinkBook 15 G3 ITL Laptop), \u0434\u043e JPCN20WW (ThinkBook 15 G4 ABA Laptop), \u0434\u043e HJCN31WW (ThinkBook 15P G2 ITH), \u0434\u043e J6CN40WW (ThinkBook 16 G4+ ARA), \u0434\u043e HYCN40WW (ThinkBook 16 G4+ IAP Laptop), \u0434\u043e KCCN31WW (ThinkBook 16p G3 ARH), \u0434\u043e KJCN27WW (ThinkBook 16p NX ARH), \u0434\u043e GYCN31WW (ThinkBook Plus G2 ITG), \u0434\u043e K6CN29WW (ThinkBook Plus G3 IAP), \u0434\u043e DNCN32WW (Yoga Creator 7-15IMH05), \u0434\u043e ERCN30WW (Yoga Duet 7-13IML05), \u0434\u043e GPCN24WW (Yoga Duet 7-13ITL6), \u0434\u043e GPCN24WW (Yoga Duet 7-13ITL6-LTE), \u0434\u043e KLCN15WW (Yoga Slim 7 Pro 16ARH7), \u0434\u043e DMCN43WW (Yoga Slim 7-14ARE05), \u0434\u043e DHCN35WW (Yoga Slim 7-14IIL05), \u0434\u043e FBCN29WW (Yoga Slim 7-14ITL05), \u0434\u043e DHCN35WW (Yoga Slim 7-15IIL05), \u0434\u043e FBCN29WW (Yoga Slim 7-15ITL05)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0438\u0437 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432.\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441\u043e \u0441\u043b\u043e\u0436\u0438\u0432\u0448\u0435\u0439\u0441\u044f \u043e\u0431\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 \u0438 \u0432\u0432\u0435\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0441\u0430\u043d\u043a\u0446\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0442\u0438\u0432 \u0420\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u043e\u0439 \u0424\u0435\u0434\u0435\u0440\u0430\u0446\u0438\u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0441\u043b\u0435 \u043e\u0446\u0435\u043d\u043a\u0438 \u0432\u0441\u0435\u0445 \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0440\u0438\u0441\u043a\u043e\u0432.\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://support.lenovo.com/us/en/product_security/ps500528-lenovo-notebook-bios-vulnerabilities",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "23.01.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "29.05.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "29.05.2023",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-02906",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-3430",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "ideapad D330-10IGM, IdeaPad 5 Pro 16ARH7, IdeaPad 5 Pro 16IAH7, IdeaPad Duet 3 10IGL5, Slim 7 16ARH7, ideapad Slim 7-14ARE05, ideapad Slim 7-14IIL05, ideapad Slim 7-14ITL05, ideapad Slim 7-15IIL05, ideapad Slim 7-15IMH05, ideapad Slim 7-15ITL05, ThinkBook 13x ITG, ThinkBook 14 G2 ARE Laptop, ThinkBook 14 G3 ITL, ThinkBook 14 G3 ACL, ThinkBook 14 G4 ABA Laptop, ThinkBook 14 G4+ ARA, ThinkBook 14 G4+ IAP Laptop, ThinkBook 14p G3 ARH, ThinkBook 14s Yoga ITL, ThinkBook 15 G2 ARE Laptop, ThinkBook 15 G2 ITL Laptop, ThinkBook 15 G3 ACL, ThinkBook 15 G3 ITL Laptop, ThinkBook 15 G4 ABA Laptop, ThinkBook 15P G2 ITH, ThinkBook 16 G4+ ARA, ThinkBook 16 G4+ IAP Laptop, ThinkBook 16p G3 ARH, ThinkBook 16p NX ARH, ThinkBook Plus G2 ITG, ThinkBook Plus G3 IAP, Yoga Creator 7-15IMH05, Yoga Duet 7-13IML05, Yoga Duet 7-13ITL6, Yoga Duet 7-13ITL6-LTE, Yoga Slim 7 Pro 16ARH7, Yoga Slim 7-14ARE05, Yoga Slim 7-14IIL05, Yoga Slim 7-14ITL05, Yoga Slim 7-15IIL05, Yoga Slim 7-15ITL05",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 WMI \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 Lenovo, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e NVRAM",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u044b\u0435 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f (CWE-276)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 WMI \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 Lenovo \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u0443\u044e NVRAM",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://support.lenovo.com/us/en/product_security/LEN-94952",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-276",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,7)"
}

CVE-2022-3430 (GCVE-0-2022-3430)

Vulnerability from cvelistv5 – Published: 2023-01-23 16:11 – Updated: 2025-04-02 15:01

Summary

A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

Severity ?

6.7 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-276 - Incorrect Default Permissions

Assigner

lenovo

References

URL

Tags

https://support.lenovo.com/us/en/product_security…

Impacted products

	Vendor	Product	Version
	Lenovo	BIOS	Affected: various

Credits

Lenovo thanks Martin Smolár from ESET for reporting these issues.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T01:07:06.525Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/LEN-94952"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-3430",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-02T15:01:24.152340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-02T15:01:31.058Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BIOS",
          "vendor": "Lenovo",
          "versions": [
            {
              "status": "affected",
              "version": "various"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Lenovo thanks Martin Smol\u00e1r from ESET for reporting these issues."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable."
            }
          ],
          "value": "A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-23T16:11:41.102Z",
        "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
        "shortName": "lenovo"
      },
      "references": [
        {
          "url": "https://support.lenovo.com/us/en/product_security/LEN-94952"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update system firmware to the version (or newer) indicated for your model in the product Impact section of LEN-94952\u003cbr\u003e"
            }
          ],
          "value": "Update system firmware to the version (or newer) indicated for your model in the product Impact section of LEN-94952\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b",
    "assignerShortName": "lenovo",
    "cveId": "CVE-2022-3430",
    "datePublished": "2023-01-23T16:11:41.102Z",
    "dateReserved": "2022-10-07T19:58:27.731Z",
    "dateUpdated": "2025-04-02T15:01:31.058Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

BDU:2023-02906

CVE-2022-3430 (GCVE-0-2022-3430)

Tags

Sightings

Nomenclature