CVE-2018-9069 BIOS Write Protection Race Condition
An attacker with administrator access can exploit a race condition to bypass BIOS write protection and alter firmware contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-9069?
CVE-2018-9069 is a medium-severity vulnerability in Lenovo Group LTD IdeaPad, published on 2 Oct 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.
Weakness: CWE-362
Which versions are affected by CVE-2018-9069?
It affects 68 products.
Products include Hp 310s-14isk Firmware, Hp 320-15ikbra Firmware, Hp 320-15ikbrn Firmware, Hp 320-15ikbrn Touch Firmware, Hp 320-17ikbrn, Hp 320s-14ikb and 62 more.
How do I fix CVE-2018-9069?
No fix has been published for CVE-2018-9069 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-9069 being exploited?
There is no known exploitation of CVE-2018-9069 in the wild and no public exploit code.
Sources
Also known as GHSA-p7mj-q6cv-6qw2.