CVE-2017-3775
Medium
Description
Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.
SeverityMedium
CVSS6.4
Exploit probability—
ProductLenovo System X3250 M6 Bios
PublishedMay 4, 2018
First seenMay 4, 2018
How to fix
Update
- lenovo system_x3250_m6_bios2.23 or later
- lenovo flex_system_x240_m5_bios2.61 or later
- lenovo flex_system_x280_x6_bios4.21 or later
- lenovo flex_system_x480_x6_bios4.21 or later
- lenovo flex_system_x880_bios4.21 or later
- lenovo nextscale_nx360_m5_bios2.61 or later
- lenovo system_x3500_m5_bios2.61 or later
- lenovo system_x3550_m5_bios2.61 or later
- lenovo system_x3650_m5_bios2.61 or later
- lenovo system_x3850_x6_bios4.3 or later
- lenovo system_x3950_x6_bios4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo system_x3250_m6_bios | v < 2.23 | 2.23 |
| lenovo flex_system_x240_m5_bios | v < 2.61 | 2.61 |
| lenovo flex_system_x280_x6_bios | v < 4.21 | 4.21 |
| lenovo flex_system_x480_x6_bios | v < 4.21 | 4.21 |
| lenovo flex_system_x880_bios | v < 4.21 | 4.21 |
| lenovo nextscale_nx360_m5_bios | v < 2.61 | 2.61 |
| lenovo system_x3500_m5_bios | v < 2.61 | 2.61 |
| lenovo system_x3550_m5_bios | v < 2.61 | 2.61 |
| lenovo system_x3650_m5_bios | v < 2.61 | 2.61 |
| lenovo system_x3850_x6_bios | v < 4.3 | 4.3 |
| lenovo system_x3950_x6_bios | v < 4.3 | 4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.