CVE-2022-3431

A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

Score

CVSS 3.1 7.8 High

Status

Modified - psirt@lenovo.com

Published

2023-10-09

Last modified

2024-09-19

Weaknesses

CWE-276

Affected products

• Bios (Lenovo)
• D330-10igl Firmware (Lenovo)
• Ideapad 5 Pro-16ach6 Firmware (Lenovo)
• Ideapad 5 Pro-16ihu6 Firmware (Lenovo)
• Ideapad 5 Pro 16arh7 Firmware (Lenovo)
• Ideapad Creator 5-16ach6 Firmware (Lenovo)
• Ideapad Duet 3 10igl5 Firmware (Lenovo)
• Ideapad Slim 7 Pro 16ach6 Firmware (Lenovo)
• Notebook (Lenovo)
• S540-15iml Firmware (Lenovo)
• Slim 7 16arh7 Firmware (Lenovo)
• Thinkbook 13x Itg Firmware (Lenovo)
• Thinkbook 14 G4+ Ara Firmware (Lenovo)
• Thinkbook 14 G4+ Iap Firmware (Lenovo)
• Thinkbook 16 G4+ Ara Firmware (Lenovo)
• Thinkbook 16 G4+ Iap Firmware (Lenovo)
• Thinkbook 16p Nx Arh Firmware (Lenovo)
• Thinkbook Plus G2 Itg Firmware (Lenovo)
• Thinkbook Plus G3 Iap Firmware (Lenovo)
• Yoga Duet 7-13iml05 Firmware (Lenovo)
• Yoga Duet 7-13itl6-lte Firmware (Lenovo)
• Yoga Duet 7-13itl6 Firmware (Lenovo)
• Yoga Slim 7-13acn05 Firmware (Lenovo)
• Yoga Slim 7-13itl05 Firmware (Lenovo)
• Yoga Slim 7 Carbon 13itl5 Firmware (Lenovo)
• Yoga Slim 7 Pro 16ach6 Firmware (Lenovo)
• Yoga Slim 7 Pro 16arh7 Firmware (Lenovo)

References

• https://support.lenovo.com/us/en/product_security/LEN-94952