¡¾Îó²îͨ¸æ¡¿Lenovo Notebook BIOS 11Ô¶à¸öÇå¾²Îó²î

Ðû²¼Ê±¼ä 2022-11-10


0x00 Îó²î¸ÅÊö

11ÔÂ8ÈÕ £¬£¬£¬Lenovo£¨åÚÏ룩Ðû²¼Lenovo Notebook BIOS¸üР£¬£¬£¬ÐÞ¸´ÁËÓ°ÏìÆä¶àÖÖÌõ¼Ç±¾µçÄÔÐͺŵĶà¸öÇå¾²Îó²î £¬£¬£¬¿ÉÒÔͨ¹ýʹÓÃÕâЩÎó²îÀ´½ûÓÃUEFI Çå¾²Æô¶¯¡£¡£¡£¡£¡£¡£

 

0x01 Îó²îÏêÇé

LenovoÊÇÒ»¼ÒÈ«Çò×ÅÃûµÄICT¿Æ¼¼ÆóÒµ £¬£¬£¬Ò²ÊÇÈ«ÇòÖÇÄÜ×°±¸µÄÏòµ¼³§ÉÌÖ®Ò»¡£¡£¡£¡£¡£¡£

Lenovo±¾´Î¸üÐÂÐÞ¸´ÁËThinkBook¡¢IdeaPad ºÍ Yoga µÈ¶àÖÖÌõ¼Ç±¾µçÄÔÐͺÅÖеÄ2¸öÎó²î £¬£¬£¬Ideapad Y700-14ISK×°±¸ÖеÄÎó²î£¨CVE-2022-3432£©ÉÐδÐÞ¸´¡£¡£¡£¡£¡£¡£

UEFIÇå¾²Æô¶¯ÊÇÒ»ÖÖÑé֤ϵͳ £¬£¬£¬¿ÉÈ·±£ÔÚÅÌËã»úÆô¶¯Àú³ÌÖв»»á¼ÓÔØºÍÖ´ÐжñÒâ´úÂë £¬£¬£¬ÀÖ³ÉʹÓÃÕâЩÎó²îµÄ¶ñÒâÓû§¿ÉÒÔ¸ü¸Ä²Ù×÷ϵͳµÄÇå¾²Æô¶¯ÉèÖà £¬£¬£¬ÏêÇéÈçÏ£º

CVE-ID

Ó°Ïì

˵Ã÷

CVE-2022-3430

½ûÓÃÇå¾²Æô¶¯

ijЩåÚÏëÌõ¼Ç±¾Éè±¹ØÁ¬ÄWMIÉèÖÃÇý¶¯³ÌÐò±£´æÎó²î £¬£¬£¬¿ÉÄܵ¼Ö¾ßÓиßȨÏ޵ĶñÒâÓû§Í¨¹ýÐÞ¸ÄNVRAM±äÁ¿À´ÐÞ¸ÄÇå¾²Æô¶¯ÉèÖᣡ£¡£¡£¡£¡£

CVE-2022-3431

½ûÓÃÇå¾²Æô¶¯

ijЩåÚÏëÌõ¼Ç±¾×°±¸µÄÖÆÔìÀú³ÌÖÐʹÓõÄÇý¶¯³ÌÐò±£´æÎó²î £¬£¬£¬¸ÃÇý¶¯³ÌÐòδ±»×¼È·Í£Óà £¬£¬£¬±»¹ýʧµØ°üÀ¨ÔÚÉú²úÖÐ £¬£¬£¬¿ÉÄܵ¼Ö¾ßÓиßȨÏ޵ĶñÒâÓû§Í¨¹ýÐÞ¸ÄNVRAM±äÁ¿À´ÐÞ¸ÄÇå¾²Æô¶¯ÉèÖᣡ£¡£¡£¡£¡£

CVE-2022-3432

½ûÓÃÇå¾²Æô¶¯

Ideapad Y700-14ISK×°±¸µÄÖÆÔìÀú³ÌÖÐʹÓõÄÇý¶¯³ÌÐò±£´æÎó²î £¬£¬£¬¸ÃÇý¶¯³ÌÐòδ±»×¼È·Í£Óà £¬£¬£¬±»¹ýʧµØ°üÀ¨ÔÚÉú²úÖÐ £¬£¬£¬¿ÉÄܵ¼Ö¾ßÓиßȨÏ޵ĶñÒâÓû§Í¨¹ýÐÞ¸ÄNVRAM±äÁ¿À´ÐÞ¸ÄÇå¾²Æô¶¯ÉèÖᣡ£¡£¡£¡£¡£

 

Ó°Ïì¹æÄ£

ThinkBook¡¢IdeaPad¡¢YogaµÈ¶àÖÖϵÁÐ/ÐͺÅ

×¢£ºÏêϸÊÜÓ°Ïì²úÆ·Ðͺż°ÆäBIOS¹Ì¼þ°æ±¾ÐÅÏ¢Çë²Î¿¼Lenovo¹Ù·½Í¨¸æÁÐ±í£º

https://support.lenovo.com/us/en/product_security/LEN-94952

 

0x02 Çå¾²½¨Òé

ÏÖÔÚLenovoÒѾ­Õë¶ÔCVE-2022-3430 ºÍ CVE-2022-3431Ðû²¼ÁËÊÜÓ°Ïì×°±¸µÄBIOS¸üР£¬£¬£¬LenovoÓû§¿É²Î¿¼¹Ù·½Í¨¸æ½«ÏµÍ³¹Ì¼þ¸üе½ÏìÓ¦ÐÞ¸´°æ±¾£¨»ò¸ü¸ß°æ±¾£©¡£¡£¡£¡£¡£¡£

¹ØÓÚCVE-2022-3432 £¬£¬£¬ÓÉÓÚIdeapad Y700-14ISKÒѵִïÉúÃüÖÜÆÚ £¬£¬£¬Lenovo½«²»ÔÙÖ§³Öά»¤ £¬£¬£¬ÊÜÓ°ÏìÓû§Ó¦µ±×¢ÖØÌá·À¡£¡£¡£¡£¡£¡£

ÏÂÔØÁ´½Ó£º

https://pcsupport.lenovo.com/us/en/

 

0x03 ²Î¿¼Á´½Ó

https://support.lenovo.com/us/en/product_security/LEN-94952

https://www.bleepingcomputer.com/news/security/lenovo-fixes-flaws-that-can-be-used-to-disable-uefi-secure-boot/

 

0x04 °æ±¾ÐÅÏ¢

°æ±¾

ÈÕÆÚ

ÐÞ¸ÄÄÚÈÝ

V1.0

2022-11-10

Ê×´ÎÐû²¼

 

 

0x05 ¸½Â¼

¼øºÚµ£±£Íø¼ò½é

¼øºÚµ£±£Íø½¨ÉèÓÚ1996Äê £¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏà £¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË £¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö £¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©

¶àÄêÀ´ £¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ £¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ £¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£¡£

 

¹ØÓÚ¼øºÚµ£±£Íø

¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£¡£¡£

¹Ø×¢ÒÔϹ«ÖںŠ£¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º

image.png