medium6.8
CVE-2017-3753
A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc.
Impact
A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Ideacentre 300-20ish Firmware | All versions |
| Lenovo | Ideacentre 300s-11ish Firmware | All versions |
| Lenovo | Ideacentre 510s-08ish Firmware | All versions |
| Lenovo | Ideacentre 700 Firmware | All versions |
| Lenovo | 63 Firmware | Version fckt78a |
| Lenovo | H50-30g Firmware | Version fckt78a |
| Lenovo | M4500 Firmware | Version fckt78a |
| Lenovo | M4500 Id Firmware | Version fckt78a |
| Lenovo | M4550 Id Firmware | Version fckt78a |
| Lenovo | S500 Firmware | Version m0kkt24a |
| Lenovo | V320-15iap Firmware | All versions |
| Lenovo | Thinkcentre E73 Firmware | Version fckt78a |