Lenovo has published a security advisory on vulnerabilities that impact its Unified Extensible Firmware Interface (UEFI) loaded on at least 100 of its laptop models.
A total of three security issues were discovered, two of them allowing an attacker to disable the protection for the SPI flash memory chip where the UEFI firmware is stored and to turn off the UEFI Secure Boot feature, which ensures the system loads at boot time only code trusted by the Original Equipment Manufacturer (OEM).
Successful exploitation of a third one, identified as CVE-2021-3970, could allow a local attacker to execute arbitrary code with elevated privileges.
All three vulnerabilities were discovered by ESET researchers and reported responsibly to Lenovo in October last year. They affect more than 100 consumer laptop models, including IdeaPad 3, Legion 5 Pro-16ACH6 H, and Yoga Slim 9-14ITL05, which likely translates to millions of users with vulnerable devices.
Drivers added by mistake
Researchers at ESET warn that the two UEFI-related vulnerabilities (CVE-2021-3971 and CVE-2021-3972) can be used by attackers to “deploy and successfully execute SPI flash or ESP implants.”
Both UEFI-related security issues in Lenovo products result from introducing into production two UEFI firmware drivers – aptly named SecureBackDoor and SecureBackDoorPeim – that are used only during manufacturing process. A security advisory from Lenovo describes the vulnerabilities like this:
- CVE-2021-3971: A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.
- CVE-2021-3972: A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
A full list of Lenovo notebook models affected by each of the three vulnerabilities is available here.
UEFI implants are hard to detect
ESET has provided a detailed technical analysis of the three vulnerabilities uncovered noting that “UEFI threats can be extremely stealthy and dangerous” because they execute “early in the boot process, before transferring control to the operating system.”
This means that most mitigations and security solutions active at the OS level are useless and payload execution is almost unavoidable and undetectable.
Detecting them is possible, although the process requires more advanced techniques like UEFI integrity checks, analyzing the firmware in real time, or monitoring the firmware behavior and the device for suspicious activity.
The cybersecurity company has discovered two such implants in the past, both used in the wild by threat actors:
- Lojax – found in 2018 and used by Russian state-backed actors tracked as APT28, Fancy Bear, Sednit, Strontium, and Sofacy
- ESPecter – identified in 2021 and active since 2012 (as a bootkit for BIOS-based systems) for persistence on the EFI System Partition (ESP)
These are not the only UEFI threat discovered, though. Kaspersky published reports on MosaicRegressor in 2020, on FinSpy in 2021, and MoonBounce in January this year.
To protect against attacks stemming from the above vulnerabilities, Lenovo recommends users of affected devices update the system firmware version to the latest available.
This can be done by installing the update manually from the support page of the device or with the help of utilities for updating system drivers provided by the company.
