SB2023120689 - Lenovo update for BIOS Image Parsing vulnerabilities (LogoFAIL)

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2023-5058)

The vulnerability allows a local user to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input. A local user with write access to the ESP of the victim device can exploit by storing a maliciously crafted logo image.

The vulnerability was dubbed LogoFAIL.

2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-39538)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. An local user can load a malicious BMP Logo file and compromise the affected system.

3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-39539)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. An local user can load a malicious PNG Logo file and compromise the affected system.

4) Input validation error (CVE-ID: CVE-2023-40238)

The vulnerability allows a local user to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input. A local user with write access to the ESP of the victim device can exploit by storing a maliciously crafted logo image.

The vulnerability was dubbed LogoFAIL.

Remediation

Install update from vendor's website.

References

• https://support.lenovo.com/us/en/product_security/LEN-145284