Qualcomm Chipsets and Lenovo BIOS Get Security Updates to Fix Multiple Flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-40520 +1 in the same advisory: …33219 | Memory corruption due to stack-based buffer overflow in Core Memory corruption due to stack-based buffer overflow in Core NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2022-3430 | A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. NVD description · AI analysis pending | 6.7 | <1% |
| — | ||
| CVE-2022-3431 | A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow a A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. NVD description · AI analysis pending | 7.8 | <1% |
| — | ||
| CVE-2022-40516 | Memory corruption in Core due to stack-based buffer overflow. Memory corruption in Core due to stack-based buffer overflow. NVD description · AI analysis pending | 7.8 group max | <1% |
| — | ||
| CVE-2022-4432 | A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure. NVD description · AI analysis pending | 4.4 | <1% |
| — |
Full article416 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 04, 2023Firmware Security
Qualcomm on Tuesday released patches to address multiple security flaws in its chipsets, some of which could be exploited to cause information disclosure and memory corruption.
The five vulnerabilities -- tracked from CVE-2022-40516 through CVE-2022-40520 -- also impact Lenovo ThinkPad X13s laptops, prompting the Chinese PC maker to issue BIOS updates to plug the security holes.
The list of flaws is as follows -
- CVE-2022-40516, CVE-2022-40517 & CVE-2022-40520 (CVSS scores: 8.4) - Memory corruption in Core due to stack-based buffer overflow
- CVE-2022-40518 & CVE-2022-40519 (CVSS scores: 6.8) - Information disclosure due to buffer over-read in Core
Stack-based buffer overflow vulnerabilities can result in severe impacts, such as data corruption, system crashes, and arbitrary code execution. Buffer over-reads, on the other hand, can be weaponized to read out-of-bounds memory, leading to the exposure of secret data.
Successful exploitation of the aforementioned flaws could allow a local adversary with elevated privileges to cause memory corruption or leak sensitive information, Lenovo noted in an alert published Tuesday.
Also remediated by Lenovo are four more buffer over-read vulnerabilities in ThinkPad X13 BIOS that could lead to information disclosure. The flaws are tracked as CVE-2022-4432, CVE-2022-4433, CVE-2022-4434, and CVE-2022-4435.
ThinkPad X13 users are recommended to update the BIOS to version 1.47 (N3HET75W) or newer. Firmware security firm Binarly has been credited with discovering and reporting the nine shortcomings.
Qualcomm's January 2023 security bulletin further closes out 17 other vulnerabilities, including one critical memory corruption bug in the Automotive component (CVE-2022-33219, CVSS score: 9.3) arising as a result of a buffer overflow flaw.
Binarly Shares Details of the Flaws
Binarly on January 9, 2023, shared more details on the security vulnerabilities, noting that "this is the first public disclosure in history of UEFI specification related to the ARM device ecosystem."
The company characterized CVE-2022-40516, CVE-2022-40517, and CVE-2022-40520 as high-impact owing to the fact that it could be exploited to achieve a secure boot bypass and permit an adversary to gain persistence on the device.
All the vulnerabilities have been found in various Driver Execution Environment (DXE) drivers, which are "responsible for initializing the processor, chipset, and platform components."
The findings also follow a related disclosure from Binarly that two Lenovo vulnerabilities that came to light in November 2022 (CVE-2022-3430 and CVE-2022-3431) continue to remain unfixed across all product lines.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/01/qualcomm-chipsets-and-lenovo-bios-get.html