medium6.7
CVE-2022-3431
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow …
Impact
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Ideapad Creator 5-16ach6 Firmware | before gscn34ww |
| Lenovo | Ideapad 5 Pro-16ihu6 Firmware | before grcn22ww |
| Lenovo | Ideapad 5 Pro-16ach6 Firmware | before gscn34ww |
| Lenovo | Yoga Slim 7-13itl05 Firmware | before f7cn39ww |
| Lenovo | Yoga Slim 7-13acn05 Firmware | before ghcn28ww |
| Lenovo | Yoga Slim 7 Pro 16arh7 Firmware | before klcn15ww |
| Lenovo | Yoga Slim 7 Pro 16ach6 Firmware | before hucn16ww |
| Lenovo | Yoga Slim 7 Carbon 13itl5 Firmware | before f7cn39ww |
| Lenovo | Yoga Duet 7-13itl6-Lte Firmware | before gpcn24ww |
| Lenovo | Yoga Duet 7-13itl6 Firmware | before gpcn24ww |
| Lenovo | Yoga Duet 7-13iml05 Firmware | before ercn30ww |
| Lenovo | Thinkbook Plus G3 Iap Firmware | before k6cn29ww |