CVE-2018-9069: BIOS Write Protection Race Condition
Published Oct 2, 2018
·Updated
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.
Affected Software
136 affected components
HP 310s-14isk Firmware<1.15
HP 310s-14isk
HP 320-15ikbra Firmware<6jcn24ww
HP 320-15ikbra
HP 320-15ikbrn Firmware<6jcn24ww
HP 320-15ikbrn
HP 320-15ikbrn Touch Firmware<6jcn24ww
HP 320-15ikbrn Touch
HP 320-17ikbrn<2.09
HP 320-17ikbrn
HP 320s-14ikb<2.09
HP 320s-14ikb
HP 320s-15ikb Firmware<2.09
HP 320s-15ikb
HP 320s-15isk Firmware<2wcn38ww
HP 320s-15isk
HP 510s-14isk Firmware<1.15
HP 510s-14isk
HP 520-15ikbrn Firmware<6jcn26ww
HP 520-15ikbrn
HP 520s-14ikb Firmware<2.09
HP 520s-14ikb
HP 710s Plus-13ikb 16g Firmware<2.55
HP 710s Plus-13ikb 16g
HP 710s Plus-3ikb Firmware<2.55
HP 710s Plus-3ikb
HP Xiaoxinair13ikbpro Firmware<2.55
HP Xiaoxinair13ikbpro
HP 710s Plus Touch-13ikb Firmware<2.55
HP 710s Plus Touch-13ikb
HP 720s-13ikb Firmware<5scn38ww
HP 720s-13ikb
HP B320-14ikb Firmware
HP B320-14ikb
Lenovo E42-80 Firmware<2wcn38ww
HP E42-80
Lenovo E52-80 Firmware<2wcn38ww
HP E52-80
HP Flex 4-1470 Firmware<1.15
HP Flex 4-1470
HP Flex 5-1470 Firmware<2.09
HP Flex 5-1470
HP Flex 5-1570 Firmware<2.09
HP Flex 5-1570
HP Ideapad 2in1 14 Firmware
HP Ideapad 2in1 14
HP Lenovo Ideapad 320-14ikb\(i\+a\) Firmware
HP Lenovo Ideapad 320-14ikb\(i\+a\)
HP Lenovo Ideapad 320-14ikb\(i\+n\) Firmware
HP Lenovo Ideapad 320-14ikb\(i\+n\)
HP Lenovo Ideapad 320-15abr Firmware
HP Lenovo Ideapad 320-15abr
HP Lenovo Ideapad 320-15ikb\(i\+n\) Firmware
HP Lenovo Ideapad 320-15ikb\(i\+n\)
HP Lenovo Ideapad 320s-14ikbr Firmware
HP Lenovo Ideapad 320s-14ikbr
HP Lenovo Ideapad 320s-15ikbr Firmware
HP Lenovo Ideapad 320s-15ikbr
HP Lenovo Ideapad 520s-14ikbr Firmware
HP Lenovo Ideapad 520s-14ikbr
HP Lenovo Ideapad 720s-14ikb Firmware<6jcn26ww
HP Lenovo Ideapad 720s-14ikb
HP Lenovo Ideapad Flex 5-1470 Firmware<6jcn26ww
HP Lenovo Ideapad Flex 5-1470
HP Lenovo Ideapad Flex 5-1570 Firmware<6jcn26ww
HP Lenovo Ideapad Flex 5-1570
HP Lenovo Ideapad Y520-15ikbn Firmware
HP Lenovo Ideapad Y520-15ikbn
HP Lenovo Tianyi 310-14ikb Firmware
HP Lenovo Tianyi 310-14ikb
HP Lenovo Tianyi 310-15ikb Firmware
HP Lenovo Tianyi 310-15ikb
HP Lenovo Y520-15ikba Firmware<5jcn25ww
HP Lenovo Y520-15ikba
HP Lenovo Y520-15ikbm Firmware<5jcn25ww
HP Lenovo Y520-15ikbm
HP Lenovo Yoga 520-14ikb Firmware<6jcn26ww
HP Lenovo Yoga 520-14ikb
HP Lenovo Yoga 520-15ikb Firmware<6jcn26ww
HP Lenovo Yoga 520-15ikb
HP Miix 720-12ikb<3scn66ww
HP Miix 720-12ikb
HP Nano110-14ikb Firmware
HP Nano110-14ikb
HP Nano110-15ikb Firmware<5xcn24ww
HP Nano110-15ikb
HP Rescuer R720-15ikbm Firmware<5xcn24ww
HP Rescuer R720-15ikbm
HP Rescuer Y520-15ikbm Firmware<5xcn24ww
HP Rescuer Y520-15ikbm
Lenovo V310-14ikb Firmware<2wcn38ww
HP V310-14ikb
Lenovo V310-14isk Firmware<4.07
HP V310-14isk
Lenovo V310-15ikb Firmware<2wcn38ww
HP V310-15ikb
Lenovo V310-15isk Firmware<0zcn47ww
HP V310-15isk
HP V330-14ikb Firmware<4.07
HP V330-14ikb
HP V330-14isk Firmware<4.07
HP V330-14isk
Lenovo V510-14ikb Firmware<2wcn38ww
HP V510-14ikb
Lenovo V510-15ikb Firmware<2wcn38ww
HP V510-15ikb
HP Yoga 310-11iap Firmware<6.7
HP Yoga 310-11iap
HP Yoga 510-14isk Firmware<1.15
HP Yoga 510-14isk
HP Yoga 720-13ikb Firmware<2.05
HP Yoga 720-13ikb
HP Yoga 720-13ikbr Firmware<2.07
HP Yoga 720-13ikbr
HP Yoga 720-15ikb Firmware<2.05
HP Yoga 720-15ikb
HP Lenovo V720-14 Firmware<2.12
HP Lenovo V720-14
HP 7000 U42 Firmware<2.09
HP 7000 U42
HP 7000-15 U42 Firmware<2.09
HP 7000-15 U42
HP R720-15ikba Firmware<5jcn25ww
HP R720-15ikba
HP Y520-15ikba Firmware<5jcn25ww
HP Y520-15ikba
HP R720-15ikbn Firmware<4gcn38ww
HP R720-15ikbn
HP Y520-15ikbn Firmware<4gcn38ww
HP Y520-15ikbn
HP Y720-15ikb Firmware<4gcn38ww
HP Y720-15ikb
HP Lenovo Y720-15ikb Firmware<4gcn38ww
HP Lenovo Y720-15ikb
HP E43-80 Kbl Firmware<4.07
HP E43-80 Kbl
Event History
Oct 2, 2018
CVE Published
01:29 PM
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-9069?
CVE-2018-9069 has a high severity rating due to its potential to allow an attacker with administrator access to alter the BIOS contents.
2
How do I fix CVE-2018-9069?
To fix CVE-2018-9069, update your BIOS to the latest version provided by the manufacturer.
3
What systems are affected by CVE-2018-9069?
CVE-2018-9069 affects several Lenovo IdeaPad consumer notebook models, particularly those with specific firmware versions.
4
Who is impacted by CVE-2018-9069?
Users of affected Lenovo IdeaPad models are at risk if they have not updated their BIOS to mitigate CVE-2018-9069.
5
Is CVE-2018-9069 being actively exploited?
As of now, there are no confirmed reports of active exploitation of CVE-2018-9069.