+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: World News (https://sinister.ly/Forum-World-News)
+--- Thread: >100 Lenovo Laptop Models Vulnerable (/Thread-100-Lenovo-Laptop-Models-Vulnerable)
>100 Lenovo Laptop Models Vulnerable - Dismas - 04-19-2022
A list of over 100 laptops made by Lenovo are susceptible to several vulnerabilities found by ESET. Updates were rolled out.
Quote:Security firm ESET said Tuesday that it has found several UEFI vulnerabilities in a wide swathe of over 100 different Lenovo consumer laptop models, which can be patched by updating the notebook’s firmware.
The full list of affected laptops includes the Ideapad-3, the Legion 5 Pro-16ACH6 H, and the Yoga Slim 9-14ITL0. ESET discovered the vulnerability late last year. Lenovo then worked to develop a patch and released it on the manufacturer’s website. ESET didn’t say whether these vulnerabilities were actively being exploited in the wild.
Specifically, the three different vulnerabilities would allow an attacker to modify either the protected boot settings or the firmware itself, a change that would survive the reinstallation of the operating system, ESET said. “UEFI threats can be extremely stealthy and dangerous,” the firm wrote. “They are executed early in the boot process, before transferring control to the operating system, which means that they can bypass almost all security measures and mitigations higher in the stack that could prevent their OS payloads from being executed.”
A third vulnerability in the SMI Handler code would allow an attacker with local access and elevated privileges to execute arbitrary code, giving them control of the machine.
Read More: https://www.pcworld.com/article/633410/up-to-100-lenovo-laptops-are-a-security-risk.html
RE: >100 Lenovo Laptop Models Vulnerable - ConcernedCitizen - 04-19-2022
I hate when websites have to use redirect links to profit off of these things. EVERY link in that page contains an affiliate link so that PCWorld gets a commission either by click-through or direct means. It should be criminal. Here are the links on that page without any bullshit:
https://support.lenovo.com/pa/en/product_security/len-73440
https://www.welivesecurity.com/2022/04/19/when-secure-isnt-secure-uefi-vulnerabilities-lenovo-consumer-laptops/
https://pcsupport.lenovo.com/us/en/
https://support.lenovo.com/us/en/product_security/LEN-73440
https://support.lenovo.com/us/en/product_security/LEN-73440#Lenovo%20Notebook
https://github.com/eset/vulnerability-disclosures/
RE: >100 Lenovo Laptop Models Vulnerable - Dismas - 04-20-2022
(04-19-2022, 11:08 PM)vittring Wrote: I hate when websites have to use redirect links to profit off of these things. EVERY link in that page contains an affiliate link so that PCWorld gets a commission either by click-through or direct means. It should be criminal. Here are the links on that page without any bullshit:
https://support.lenovo.com/pa/en/product_security/len-73440
https://www.welivesecurity.com/2022/04/19/when-secure-isnt-secure-uefi-vulnerabilities-lenovo-consumer-laptops/
https://pcsupport.lenovo.com/us/en/
https://support.lenovo.com/us/en/product_security/LEN-73440
https://support.lenovo.com/us/en/product_security/LEN-73440#Lenovo%20Notebook
https://github.com/eset/vulnerability-disclosures/
That's shitty. I've gone ahead and edited the post to use direct links.
RE: >100 Lenovo Laptop Models Vulnerable - ConcernedCitizen - 04-20-2022
All good. Considering that a lot of websites are barely staying afloat right now, I understand the reasoning. But you don't just enforce affiliate links across your entire website. That doesn't fly.
RE: >100 Lenovo Laptop Models Vulnerable - mothered - 04-20-2022
(04-19-2022, 11:08 PM)vittring Wrote: I hate when websites have to use redirect links to profit off of these things. EVERY link in that page contains an affiliate link so that PCWorld gets a commission either by click-through or direct means. It should be criminal.I couldn't agree more.
It's pathetic how companies on that scale, stoop so low to use redirection links.
(04-19-2022, 11:08 PM)vittring Wrote: Here are the links on that page without any bullshit:Good work.
https://support.lenovo.com/pa/en/product_security/len-73440
https://www.welivesecurity.com/2022/04/19/when-secure-isnt-secure-uefi-vulnerabilities-lenovo-consumer-laptops/
https://pcsupport.lenovo.com/us/en/
https://support.lenovo.com/us/en/product_security/LEN-73440
https://support.lenovo.com/us/en/product_security/LEN-73440#Lenovo%20Notebook
https://github.com/eset/vulnerability-disclosures/