Lenovo has confirmed that reports of a critical vulnerability in the UEFI (unified extensible firmware interface) in its ThinkPad computers are accurate and it is currently investigating the problem.
Lenovo released a statement on June 30 verifying there is a vulnerability in the ThinkPad's System Management Mode (SMM) BIOS that was introduced by one of its independent BIOS vendors. However, Lenovo hasn't specified what range of ThinkPad models likely are affected by the vulnerability.
The UEFI is a current version of what used to be called the BIOS (basic input output system), which forms an interface between the computer hardware and the operating system, such as Microsoft Windows. The current practice is that the IBVs (independent BIOS vendors) work from reference code provided by the CPU manufacturer and then develops machine-specific code that provides the rest of the machine-specific interface.
Normally, machines using similar processors and chipsets will use the same reference code. This means that while the vulnerability could have been introduced by the IBV, it's also possible it was introduced by Intel when it created the reference code.
The vulnerability was found by an independent security researcher Dmytro Oleksiuk, who published details on GitHub, a software development collaboration site. Oleksiuk said in his posting that the vulnerability, which he has named ThinkPwn, allows the running of arbitrary SMM code. This enables an attacker to disable Flash write protection and then allow malware infection of the platform firmware. This, in turn, allows an attacker to disable Secure Boot and Virtual Secure Mode on Windows 10.
By embedding malware in the system firmware, an attacker can avoid detection by antimalware software. Furthermore, the malware may be difficult or impossible to remove. Oleksiuk noted in his GitHub entry that the vulnerability apparently was fixed by Intel in 2014, but because there was no public announcement, the vulnerability was never removed by computer makers that were using the earlier version in their UEFI code.
Further research by Oleksiuk and others appears to indicate that Lenovo isn't the only computer maker affected by the same bug. Independent security researcher Alex James reported in a series of Tweets that he found the same vulnerability on some HP laptop computers and in the firmware for some Gigabyte Technology motherboards.
The vulnerability was discovered so recently that the full extent of the problem is unknown. But because Intel and the independent BIOS vendors likely used similar reference code and UEFI software as much as possible, the problem is likely to be much more widespread than just the three makers that are currently known.
While Lenovo has acknowledged that the vulnerability exists, there's more to attacking a computer than the existence of a vulnerability. At the very least, there needs to be a means of delivering it.