CVE-2019-6156 Security feature bypass in BIOS
Lenovo BIOS fails to restore SPI Protected Range Registers after sleep, bypassing a secondary defense layer while primary protection remains active.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-6156?
CVE-2019-6156 is a low-severity vulnerability in Lenovo BIOS, published on 10 Apr 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
Weakness: CWE-667
Which versions are affected by CVE-2019-6156?
It affects 177 products.
Products include Lenovo 330-14igm Firmware, Lenovo 330-15igm Firmware, Lenovo 510-15ikl Firmware, Lenovo 510s-08ikl Firmware, Lenovo 530s-07icb Firmware, Lenovo Aio300-23isu\(c5130\) Firmware and 171 more.
How do I fix CVE-2019-6156?
No fix has been published for CVE-2019-6156 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-6156 being exploited?
There is no known exploitation of CVE-2019-6156 in the wild and no public exploit code.
Sources
Also known as GHSA-9wmj-xcgw-57p9.