¡¾·ì϶¹«¸æ¡¿Lenovo Notebook BIOS¶à¸ö°²È«·ì϶

°ä²¼¹¦·ò 2022-04-20

0x00 ·ì϶¸ÅÊö

2022Äê4ÔÂ19ÈÕ£¬Lenovo£¨åÚÏ룩°ä²¼°²È«²¼¸æ£¬½¨¸´ÁË3¸öÓ°ÏìÉϰٿîåÚÏë±Ê¼Ç±¾µçÄÔÐÍºÅµÄ UEFI ¹Ì¼þ·ì϶¡£

 

0x01 ·ì϶ÏêÇé

Õâ3¸ö·ì϶¶¼´æÔÚÓÚLenovo Notebook BIOSÖС£ÆäÖÐCVE-2021-3971ºÍCVE-2021-3972Ó°ÏìÁË UEFI ¹Ì¼þÇý¶¯·¨Ê½£¬CVE-2021-3970ÔÊÐí¶Ô SMRAM ½øÐÐËÁÒâ¶Á/д£¬Õâ¿ÉÄܵ¼ÖÂʹÓà SMM ȨÏÞÖ´ÐжñÒâ´úÂë¡£ÏêÇéÈçÏ£º

CVE-2021-3970£ºSMM ËÁÒâ¶Á/д

ÔÚijЩåÚÏë±Ê¼Ç±¾ÐͺÅÖУ¬ÓÉÓÚÑéÖ¤²»¼°£¬LenovoVariable SMI´¦Ö÷¨Ê½´æÔÚ°²È«ÎÊÌ⣬¿ÉÔÚÓµÓб¾µØ½Ó¼ûȨÏÞ£¨ºÍÌáÉýµ½¸ü¸ßȨÏÞ£©µÄÇé¿öÏÂÖ´ÐÐËÁÒâ´úÂë¡£

CVE-2021-3971£º½ûÓà SPI ÉÁ´æ±£»¤

ÔÚijЩåÚÏë±Ê¼Ç±¾É豸ÉÏ£¬´æÔÚ°²È«ÎÊÌâµÄ¾ÉµÄUEFI ¹Ì¼þÇý¶¯·¨Ê½±»ÃýÎóµØÔ̺¬ÔÚ³ö²ú BIOS Ó³ÏñÖжøÃ»Óб»ÕýÈ·Í£Óá£ÕâЩÊÜÓ°ÏìµÄ¹Ì¼þÇý¶¯·¨Ê½Äܹ»±»¼¤»î£¬ÒÔÔÚϵͳÔËÐÐʱ´ÓÌØÈ¨Óû§Ä£Ê½¹ý³ÌÖ±½Ó½ûÓà SPI ÉÁ´æ±£»¤£¨BIOS ½ÚÔì¼Ä·ÅÆ÷λºÍÊܱ£»¤ÁìÓò¼Ä·ÅÆ÷£©¡£

CVE-2021-3972£º½ûÓà UEFI °²È«Æô¶¯

ÔÚijЩåÚÏë±Ê¼Ç±¾É豸ÉÏ£¬´æÔÚ°²È«ÎÊÌâµÄ¾ÉµÄUEFI ¹Ì¼þÇý¶¯·¨Ê½±»ÃýÎóµØÔ̺¬ÔÚ³ö²ú BIOS Ó³ÏñÖжøÃ»Óб»ÕýÈ·Í£Óá£ÕâЩÊÜÓ°ÏìµÄ¹Ì¼þÇý¶¯·¨Ê½Äܹ»±»¼¤»î£¬ÒÔÔÚϵͳÔËÐÐʱ´ÓÌØÈ¨Óû§Ä£Ê½¹ý³ÌÖ±½Ó½ûÓÃUEFI °²È«Êèµ¼Ö°ÄÜ¡£

 

Ó°ÏìÁìÓò

IdeaPad¡¢Legion¡¢Flex ºÍ YogaµÈÉϰٿîÐͺÅ

 

0x02 ´ëÖý¨Òé

ĿǰåÚÏëÒѾ­°ä²¼BIOS ¸üУ¬Óû§Äܹ»¸üС£

¾ßÌåÐͺż°ÆäBIOS ¸üпɲο¼åÚÏë¹Ù·½²¼¸æ£º

https://support.lenovo.com/us/en/product_security/LEN-73440#Lenovo%20Notebook

 

0x03 ²Î¿¼Á´½Ó

https://support.lenovo.com/us/en/product_security/LEN-73440#Lenovo%20Notebook

https://www.welivesecurity.com/2022/04/19/when-secure-isnt-secure-uefi-vulnerabilities-lenovo-consumer-laptops/

https://www.bleepingcomputer.com/news/security/lenovo-uefi-firmware-driver-bugs-affect-over-100-laptop-models/

 

0x04 ¸üа汾

°æ±¾

ÈÕÆÚ

Åú¸ÄÄÚÈÝ

V1.0

2022-04-20

³õ´Î°ä²¼

 

0x05 ¸½Â¼

GA»Æ½ð¼×¼ò½é

GA»Æ½ð¼×¹«Ë¾³ÉÁ¢ÓÚ1996Ä꣬²¢ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉî½»ËùÖÐÓ×°åÕýʽ¹ÒÅÆÉÏÊУ¬ÊǹúÄÚ¼«¾ßʵÁ¦µÄ¡¢Õ¼ÓÐÆëÈ«×ÔÖ÷֪ʶ²úȨµÄÍøÂ簲ȫ²úÆ·¡¢¿ÉÐŰ²È«ÖÎÀíÆ½Ì¨¡¢°²È«·þÎñÓë½â¾ö¹æ»®µÄ×ÛºÏÌṩÉÌ¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°£¬ÔÚÈ«¹ú¸÷Ê¡¡¢ÊÓ×¢×ÔÖÎÇøÉèÓзÖÖ§»ú¹¹£¬Õ¼Óи²¸ÇÈ«¹úµÄÇþ·ϵͳºÍ¼¼ÊõÖ§³ÖÖÐÐÄ£¬²¢ÔÚ±±¾©¡¢ÉϺ£¡¢³É¶¼¡¢¹ãÖÝ¡¢³¤É³¡¢º¼ÖÝµÈ¶àµØÉèÓÐÑз¢ÖÐÐÄ¡£

¶àÄêÀ´£¬GA»Æ½ð¼×ÖÂÁ¦ÓÚÌṩӵÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷´´Ðµİ²È«²úÆ·ºÍ×î¼Ñʵ¼Ê·þÎñ£¬Ô®ÊÖ¿Í»§È«ÃæÌáÉýÆäIT»ù´¡ÉèÊ©µÄ°²È«ÐԺͳö²úЧÁ¦£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢°²È«²úÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸ÖÂÁ¦¡£

 

¹ØÓÚGA»Æ½ð¼×

GA»Æ½ð¼×°²È«Ó¦¼±ÏìÓ¦ÖÐÐÄÖØÒªÕë¶Ô³ÁÒª°²È«·ì϶µÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвµý±¨ºÍ°²È«»ã±¨¡£

¹Ø×¢ÒÔϹ«¼ÒºÅ£¬»ñȡȫÇò×îа²È«×ÊѶ£º

image.png