Vulnerabilities CVE-2021-3922, CVE-2021-3969 in ImController of Lenovo Notebooks

guest · Dec 21, 2021

December 21, 2021

Lenovo notebooks and devices that use the ImController service are vulnerable to a privilege escation vulnerability. This can allow attackers to execute commands with administrator privileges on the devices. However, there is an update to address both vulnerabilities.

I already came across the information from colleagues here the other days, so I'm posting it as a security topic. Security researchers at NCC Group have released this advisory on Dec. 15, 2021, regarding the vulnerabilities in Lenovo notebooks and Yoga devices.
Click to expand...

The ImController service
Lenovo ships a special ImController service pre-installed on its notebook and Yoga devices. The ImController service is installed on specific Lenovo devices (e.g., ThinkPad) and runs as a SYSTEM user. The service periodically runs subordinate processes for system configuration and maintenance tasks.
Click to expand...

According to this Lenovo support document, the following vulnerabilities exist. ID.

CVE-2021-3922: A race condition vulnerability in MController that could allow a local attacker to connect to and interact with the named pipe of the IMController subprocess.

CVE-2021-3969: A Time of Check Time of Use (TOCTOU) vulnerability in MController that could allow a local attacker to escalate privileges.

Click to expand...

Both vulnerabilities can only be exploited locally, but could cause some damage in a chain of vulnerabilities. Lenovo has since provided an update in the form of Lenovo System Interface Foundation version 1.1.20.3 (see support document ), which fixes the vulnerabilities. According to this Lenovo forum post, the component should update itself automatically.
Click to expand...

NCC Group: Technical Advisory – Lenovo ImController Local Privilege Escalation (CVE-2021-3922, CVE-2021-3969)

Summary
The ImController service comes installed on certain Lenovo devices, for example NCC found the service installed on a ThinkPad workstation. The service runs as the SYSTEM user and periodically executes child processes which perform system configuration and maintenance tasks.
Impact
Elevation of privilege. An attacker can elevate their privileges to that of the SYSTEM user from a user that is able to write files to the filesystem.
Click to expand...

Log in or Sign up

Vulnerabilities CVE-2021-3922, CVE-2021-3969 in ImController of Lenovo Notebooks

guest Guest

Log in or Sign up

Vulnerabilities CVE-2021-3922, CVE-2021-3969 in ImController of Lenovo Notebooks

guest Guest

Useful Searches