If you own a Lenovo laptop, be aware that researchers at ESET have recently discovered a trio of bugs reported to Lenovo that could allow an attacker to disable security features and hijack your operating system.

The issues are tracked as CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892 and are all classed as medium severity level.

The first of these is an issue in the ReadcyBootDxe driver used in some of Lenovo’s products, while the other two are overflow bugs in the SystemLoadDefaultDxe driver.

Unfortunately, the issue is quite widespread, as the SystemLoadDefaultDxe driver is used in more than 70 different Lenovo models. That includes everything in the IdeaPad, Flex, ThinkBook, V14, V15, V130, Slim, S145, S540, S940, and Yoga product lines.

The company has issued a formal advisory regarding the issue and has a complete listing of all their products impacted by these flaws on their website.

ESET had this to say about their recent discovery:

“These vulnerabilities were caused by insufficient validation of DataSize parameter passed to the UEFI Runtime Services function GetVariable.  An attacker could create a specially crafted NVRAM variable, causing buffer overflow of the Data buffer in the second GetVariable call.”

If there’s a silver lining to be found here, it lies in the fact that exploiting these flaws is not a trivial task and requires a skillset that is likely beyond a great many of the world’s hackers.

That does not mean that you are safe. You are very much at risk. The good news though is that at least a casual or relatively inexperienced hacker will not be able to easily exploit these weaknesses.  They’re still well worth keeping on your company’s radar, however.

One final note to be aware of is that if you’re having trouble determining whether your Lenovo is on the vulnerable list, the company has published a website that auto-detects for the vulnerability.  It is hands down the fastest way to find out for sure. Good luck out there!

Related Posts - TKS Blog

keyless password
The State Of Passwords in 2025
Passwords have long been a necessary but frustrating aspect of digital security. Most users either dislike them or outright despise them. Despite the growing push...
Read more
TKS Newsletter - 2025 February
Here's our February 2025 Newsletter Read the full PDF version here: The TKS Sentinel - February Issue In this month's edition, we discuss: Work-Specific Tools Windows 11...
Read more
common password mistakes
Password Management Tips For Businesses
Is Your Business Cyber Secure? Passwords are the front line of defense against cyberattacks. Yet, most businesses still struggle with password security—whether it’s employees using weak...
Read more
password managers for business
How Password Managers Strengthen Your Cybersecurity Posture
The Growing Threat of Password Vulnerabilities Protecting your sensitive business information has never been more critical than it is today. Passwords remain one of the weakest...
Read more

Used with permission from Article Aggregator