# CVE-2018-9069: BIOS Write Protection Race Condition

> An attacker with administrator access can exploit a race condition to bypass BIOS write protection and alter firmware contents.

- **Severity:** Medium 5.9 (`CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 2 Oct 2018
- **Updated:** 5 Aug 2024
- **Also known as:** GHSA-p7mj-q6cv-6qw2

## What is CVE-2018-9069?

CVE-2018-9069 is a medium-severity vulnerability in Lenovo Group LTD IdeaPad, published on 2 Oct 2018. An attacker needs administrator access to exploit it, with no action from the victim.

### Official description

In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.

Weakness: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)

## Which versions are affected by CVE-2018-9069?

It affects 68 products.


Products: Hp 310s-14isk Firmware, Hp 320-15ikbra Firmware, Hp 320-15ikbrn Firmware, Hp 320-15ikbrn Touch Firmware, Hp 320-17ikbrn, Hp 320s-14ikb, Hp 320s-15ikb Firmware, Hp 320s-15isk Firmware, Hp 510s-14isk Firmware, Hp 520-15ikbrn Firmware, Hp 520s-14ikb Firmware, Hp 7000-15 U42 Firmware, Hp 7000 U42 Firmware, Hp 710s Plus-13ikb 16g Firmware, Hp 710s Plus-3ikb Firmware, Hp 710s Plus Touch-13ikb Firmware, Hp 720s-13ikb Firmware, Hp B320-14ikb Firmware, Hp E43-80 Kbl Firmware, Hp Flex 4-1470 Firmware and 48 more.

## How do I fix CVE-2018-9069?

No fix has been published for CVE-2018-9069 yet. Limit exposure of the affected software until one is available.

## Is CVE-2018-9069 being exploited?

There is no known exploitation of CVE-2018-9069 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2018-9069 and fix it if it is affected.

What it is: CVE-2018-9069 is a medium-severity vulnerability in Lenovo Group LTD IdeaPad, published on 2 Oct 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2018-9069 in the wild and no public exploit code.

Affected product: Lenovo Group LTD IdeaPad. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2018-9069/ (Markdown: https://insights.sbomify.com/CVE-2018-9069/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2018-9069
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-9069
- OSV: https://osv.dev/vulnerability/CVE-2018-9069

---
From sbomify Insights: https://insights.sbomify.com/CVE-2018-9069/
Summaries are generated and may contain mistakes; the official description above is the record.