CVE-2024-26836

What it actually does

Incorrect password opcode ordering in the think-lmi driver allows attribute value changes to occur before password verification when an admin password is enabled on Lenovo workstations.

Why it matters to the business

Unauthorized local configuration changes become possible on affected Lenovo systems, potentially altering BIOS/UEFI settings and impacting device security posture or compliance.

How an attack unfolds

An attacker with local access to a vulnerable Linux kernel on a Lenovo workstation issues LMI attribute change requests; because the password opcode runs after the change instead of before, the admin password check is bypassed and the modification succeeds.

How to fix it

Update the Linux kernel to a version containing commit 2deb10a99671afda30f834e95e5b992a805bba6a or later; rebuild and deploy the updated kernel on all affected Lenovo systems.

How to confirm the fix worked

Confirm the running kernel contains commit 2deb10a99671afda30f834e95e5b992a805bba6a; test that password-protected attribute changes now correctly require the password opcode first.

Typical attack path

1. Gain local access or code execution on a Linux system running a vulnerable kernel version on supported Lenovo hardware
2. Interact with the think-lmi sysfs interface to enumerate or target password-protected attributes
3. Submit attribute modification requests without first issuing the required password opcode
4. Observe successful change of BIOS/UEFI settings that should have been protected

How to detect it

Review system logs for unexpected think-lmi attribute modifications; correlate with authentication events around BIOS/UEFI setting changes on Lenovo workstations.

What your security team should do

• Apply the fixed kernel commit to all Lenovo Linux deployments within standard change windows
• Review any scripts or tools that interact with think-lmi attributes for password handling assumptions
• Monitor vendor kernel updates for backports to supported distribution releases