Lenovo has just patched three (3) critical vulnerabilities affecting more than one hundred (100) laptop models that could allow attackers to escalate their local privileges and execute arbitrary code to directly disable BIOS flash protections in order to infect targets with Unified Extensible Firmware Interface (UEFI) Secure Boot malware strains. UEFI cyberattacks are highly effective due to computers not having active memory protections at the hardware level. This exploit is deployed against the target during the boot process, which means that the attackers can potentially bypass security measures that typically only load at the OS boot stage, and reconfigure data, as well as establish persistence within the system. These vulnerabilities were discovered by the security research firm ESET in October 2021 and were responsibly reported to Lenovo. According to Lenovo, the two (2) firmware driver flaws exist due to mistakes from older manufacturing processes. One of the flaws (CVE-2021-3971) was the result of accidentally including a driver in the BIOS image, allowing attackers to potentially modify firmware security with an arbitrary NVRAM variable. The other (CVE-2021-3972) is from a driver that wasn’t deactivated during the development of certain Lenovo Notebook devices, and the third (CVE-2021-3970) is what allows for the malware sets to be installed due to an improper input validation that causes SMM memory corruption. The UEFI attacks come in the form of well-known SPI flash implants and ESP implants such as “LoJax,” and “ESPecter.” Historically, UEFI threats have been less popular due to their perceived complexity, but the rise in UEFI attacks hints that threat actors have identified their value and learned how to execute these complex attacks. These vulnerabilities have been patched, and Lenovo recommends all users upgrade their machines immediately. There are out-of-support legacy Lenovo machines that cannot be patched with this update, and in those cases, users should leverage TPM-aware full-disk encryption software to make UEFI Secure Boot configurations inaccessible.