PT-2022-22120 · Lenovo · Lenovo Notebook

Published 2022-11-10 · Updated 2023-10-14 · CVE-2022-3431

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo Notebook devices (affected versions not specified)

Description A potential issue in a driver used during the manufacturing process on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot settings by modifying an NVRAM variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-3431

Affected Products

Lenovo Notebook

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-3431 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3431 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-94952 · Vendor Advisory
• https://t.me/echeloneyes/868 · Telegram Post
• https://t.me/true_secator/3685 · Telegram Post
• https://t.me/cibsecurity/71859 · Telegram Post
• https://t.me/ckure/12130 · Telegram Post