CVE-2022-3431

A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

• lenovo ideapad creator 5-16ach6 firmware (< gscn34ww) • lenovo ideapad 5 pro-16ihu6 firmware (< grcn22ww) • lenovo ideapad 5 pro-16ach6 firmware (< gscn34ww) • lenovo yoga slim 7-13itl05 firmware (< f7cn39ww) • lenovo yoga slim 7-13acn05 firmware (< ghcn28ww) • lenovo yoga slim 7 pro 16arh7 firmware (< klcn15ww) • lenovo yoga slim 7 pro 16ach6 firmware (< hucn16ww) • lenovo yoga slim 7 carbon 13itl5 firmware (< f7cn39ww) • lenovo yoga duet 7-13itl6-lte firmware (< gpcn24ww) • lenovo yoga duet 7-13itl6 firmware (< gpcn24ww) • lenovo yoga duet 7-13iml05 firmware (< ercn30ww) • lenovo thinkbook plus g3 iap firmware (< k6cn29ww) • lenovo thinkbook plus g2 itg firmware (< gycn31ww) • lenovo thinkbook 16p nx arh firmware (< kjcn27ww) • lenovo thinkbook 16 g4\+ iap firmware (< hycn40ww) • lenovo thinkbook 16 g4\+ ara firmware (< j6cn40ww) • lenovo thinkbook 14 g4\+ iap firmware (< hycn40ww) • lenovo thinkbook 14 g4\+ ara firmware (< j6cn40ww) • lenovo thinkbook 13x itg firmware (< hlcn30ww) • lenovo ideapad slim 7 pro 16ach6 firmware (< hucn16ww) • lenovo s540-15iml firmware (< cncn22ww) • lenovo slim 7 16arh7 firmware (< klcn15ww) • lenovo ideapad duet 3 10igl5 firmware (< eqcn37ww) • lenovo ideapad 5 pro 16arh7 firmware (< j4cn33ww) • lenovo d330-10igl firmware (< g0cn11ww)