CVE-2022-4575
First published: Mon Oct 30 2023(Updated: )
A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.
Credit: psirt@lenovo.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lenovo Thinkpad 25 Firmware | <1.73 | |
| Lenovo Thinkpad 25 | ||
| Lenovo Thinkpad L560 Firmware | <1.62 | |
| Lenovo Thinkpad L560 | ||
| Lenovo Thinkpad P50 Firmware | <1.71 | |
| Lenovo Thinkpad P50 | ||
| Lenovo Thinkpad P50s Firmware | <1.45 | |
| Lenovo Thinkpad P50s | ||
| Lenovo Thinkpad P70 Firmware | <2.45 | |
| Lenovo Thinkpad P70 | ||
| Lenovo Thinkpad T470 Firmware | <1.73 | |
| Lenovo Thinkpad T470 | ||
| Lenovo Thinkpad T470s Firmware | <1.49 | |
| Lenovo Thinkpad T470s | ||
| Lenovo Thinkpad T560 Firmware | <1.45 | |
| Lenovo Thinkpad T560 | ||
| Lenovo Thinkpad X1 Carbon 4th Gen Firmware | <1.56 | |
| Lenovo Thinkpad X1 Carbon 4th Gen | ||
| Lenovo Thinkpad X1 Yoga 1st Gen Firmware | <1.56 | |
| Lenovo Thinkpad X1 Yoga 1st Gen | ||
| Lenovo Thinkpad X260 Firmware | <1.50 | |
| Lenovo Thinkpad X260 | ||
| Lenovo Thinkpad X270 Firmware | <1.47 | |
| Lenovo Thinkpad X270 | ||
| Lenovo Thinkpad Yoga 260 Firmware | <1.88 | |
| Lenovo Thinkpad Yoga 260 |
Remedy
Update system firmware to the version (or newer) indicated for your model in the Product Impact section of LEN-106014.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-4575?
CVE-2022-4575 is a vulnerability due to improper write protection of UEFI variables in the BIOS of certain ThinkPad models.
How does CVE-2022-4575 affect Lenovo ThinkPad models?
CVE-2022-4575 allows an attacker with physical or local access and elevated privileges to bypass Secure Boot on affected ThinkPad models.
What is the severity of CVE-2022-4575?
The severity of CVE-2022-4575 is medium, with a CVSS score of 6.7.
Which Lenovo ThinkPad models are affected by CVE-2022-4575?
CVE-2022-4575 affects certain ThinkPad models, including ThinkPad 25, ThinkPad L560, ThinkPad P50, ThinkPad P50s, ThinkPad P70, ThinkPad T470, ThinkPad T470s, ThinkPad T560, ThinkPad X1 Carbon 4th Gen, ThinkPad X1 Yoga 1st Gen, ThinkPad X260, ThinkPad X270, and ThinkPad Yoga 260.
How can I fix CVE-2022-4575?
To fix CVE-2022-4575, Lenovo has provided a firmware update for the affected ThinkPad models. Please refer to the Lenovo website for more information and instructions.
- collector/nvd-api
- agent/weakness
- agent/type
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/lenovo
- canonical/lenovo thinkpad 25 firmware
- canonical/lenovo thinkpad 25
- canonical/lenovo thinkpad l560 firmware
- canonical/lenovo thinkpad l560
- canonical/lenovo thinkpad p50 firmware
- canonical/lenovo thinkpad p50
- canonical/lenovo thinkpad p50s firmware
- canonical/lenovo thinkpad p50s
- canonical/lenovo thinkpad p70 firmware
- canonical/lenovo thinkpad p70
- canonical/lenovo thinkpad t470 firmware
- canonical/lenovo thinkpad t470
- canonical/lenovo thinkpad t470s firmware
- canonical/lenovo thinkpad t470s
- canonical/lenovo thinkpad t560 firmware
- canonical/lenovo thinkpad t560
- canonical/lenovo thinkpad x1 carbon 4th gen firmware
- canonical/lenovo thinkpad x1 carbon 4th gen
- canonical/lenovo thinkpad x1 yoga 1st gen firmware
- canonical/lenovo thinkpad x1 yoga 1st gen
- canonical/lenovo thinkpad x260 firmware
- canonical/lenovo thinkpad x260
- canonical/lenovo thinkpad x270 firmware
- canonical/lenovo thinkpad x270
- canonical/lenovo thinkpad yoga 260 firmware
- canonical/lenovo thinkpad yoga 260