# MA-506.082015: MyCERT Advisory - Lenovo Service Engine (LSE) BIOS Vulnerability

**Date:** 14 Aug 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-506.082015  
**Advisory ID:** MA-506.082015

---

#### **1.0 Introduction**
Certain Lenovo personal computers contain a vulnerability in LSE (a Lenovo BIOS feature). Users and administrators are encouraged to review the Lenovo Security Advisories for notebooks and desktops and apply the necessary updates and mitigations.
**2.0 Impact**
Exploitation of this vulnerability may allow a remote attacker to take control of an affected system.
**3.0 Affected ProductsNotebook models:**
Flex 2 Pro-15/Edge 15 (Broadwell)
Flex 2 Pro-15/Edge 15 (Haswell)
Flex 3-1470/1570
Flex 3-1120
G40-80/G50-80/G50-80 Touch/V3000
S21e
S41-70/U40-70
S435/M40-35
Yoga 3 14
Yoga 3 11
Y40-80
Z41-70/Z51-70
Z70-80 / G70-80
**Desktop models:**
Note: Only systems with a manufacture date of 10/23/14 through 4/10/15 and manufactured with Windows 8 or 8.1 may contain LSE. If LSE is not enabled, it will not be shown under the “Security” tab in the system BIOS and the user is not affected.
A540/A740
B4030
B5030
B5035
B750
C2005
C4005
C2030/C4030
C260
C5030
H3000
H3050
H5000
H5055
H5050
Horizon2 27
Horizon 2e(Yoga Home 500)
Horizon 2S
X310(A78)
X315(B85)
**4.0 RecommendationsNotebooks:For Windows 8, 8.1 and 10**
1. If the user is running Windows in UEFI mode:
Run the Lenovo LSE disabler tool as an administrator. A command line window will pop up, stay for approximately 30 seconds and then close automatically. The Lenovo LSE disabler tool is available here.
The disabler tool automatically performs the following actions:
> a) Stops the LSE service
> b) Deletes all files installed by the LSE module, which include
>
> > C:\windows\system32\wpbbin.exe
> > C:\windows\system32\LenovoUpdate.exe
> > C:\windows\system32\LenovoCheck.exe
>
> c) Repairs the autocheck files in Windows
> d) Disables the UEFI variable that enables LSE if the system is running Windows 8, 8.1  or 10 in UEFI mode
2. Restart your PC
For Windows 7 in any mode, or Windows 8, Windows 8.1 and Windows 10 installed in legacy mode, or if you are not sure if your system is running in either UEFI or legacy mode:
1. Please update your system to run at the latest level BIOS. To do so, please download the update at the appropriate URL below. The systems listed below need to be running at or above the following BIOS versions. The latest level BIOS disables the LSE functionality:
|  |
| --- | --- | --- | **Model** | **Minimum Fix  Version** | **Download URL** | Flex 2 Pro-15/Edge 15 (Broadwell) | A9CN46WW | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/flex-series/flex-2-pro-15-laptop-lenovo> | Flex 2 Pro-15/Edge 15 (Haswell) | B9CN17WW | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/flex-series/flex-2-pro-15-laptop-lenovo> | Flex 3-1470/1570 | BDCN30WW | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/flex-series/flex-3-1470> | Flex 3-1120 | C0CN25WW | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/flex-series/flex-3-1120/downloads/DS102815> | G40-80/G50-80/G50-80 Touch/V3000 | B0CN75WW | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-g-series-laptops/g40-80/downloads/DS102231> | S21e | C4CN14WW(V1.04) | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-s-series-laptops/s21e-20/downloads/DS102813> | S41-70/U41-70 | BDCN30WW | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/u-series/u41-70> | S435/M40-35 | BBCN15WW(V1.06) | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-s-series-laptops/s435> | Yoga3 14 | BACN33WW | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/yoga-series/yoga-3-1470/downloads/DS102769> | Z70-80 / G70-80 | ABCN75WW | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-z-series-laptops/z70-80/downloads/DS102563> | Yoga 3 11 | B8CN30WW(V2.08) | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/yoga-series/yoga-3-1170/downloads/DS102768> | Y40-80 | B5CN36WW(V2.02) | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-y-series-laptops/y40-80> | Z41-70/Z51-70 | C2CN18WW(V1.04) | <http://support.lenovo.com/us/en/products/laptops-and-netbooks/lenovo-z-series-laptops/z41-70/downloads/DS102767> |
2. Follow the instructions in the Lenovo LSE disabler tool readme file to run the disabler tool. A command line window will pop up, stay for approximately 30 seconds and then close automatically. The Lenovo LSE disabler tool is available here (<https://support.lenovo.com/us/en/downloads/ds104370>)
> The disabler tool automatically performs the following actions:
> a) Stops the LSE service
> b) Deletes all files installed by the LSE module, which include
>
> > C:\windows\system32\wpbbin.exe
> > C:\windows\system32\LenovoUpdate.exe
> > C:\windows\system32\LenovoCheck.exe
>
> c) Repairs the autocheck files in Windows
> d)Automatically disables the UEFI variable that enables LSE if the system is running Windows 8, 8.1  or 10 in UEFI mode
3. Restart your PC
**Desktops:For Windows 8 and 8.1**
In order to disable LSE on desktop systems, please complete the following two steps:
1. Disable LSE in the system BIOS. To do this, press F1 while the system is booting to boot into the system BIOS. Press the right arrow to move over to the “Security” tab. Set the “Lenovo Service Engine” option to “disabled”. If you do not see an option for Lenovo Service Engine in your desktop system's BIOS, it is not enabled in your system and running the disable utility is not needed. Press F10 to Save and Exit.
2. Download the RemoveLSEDT utility available here (<https://support.lenovo.com/us/en/downloads/ds104373>) from the Lenovo support website. Boot to Windows. Right click on the “RemoveLSEDT.bat” file and select “Run as Administrator”. This batch file will remove the following files on your system:
- C:\windows\system32\LSEDT.exe
- C:\windows\system32\LSEPreDownloader.exe
The user can also delete the files manually instead of running the disable utility.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#7f1c061d1a0d4646463f1c061d1a0d0c1a1c0a0d160b06511206) or [[email protected]](/cdn-cgi/l/email-protection#bed3c7dddbcccafed3c7dddbccca90d1ccd990d3c7) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- <https://www.us-cert.gov/ncas/current-activity/2015/08/12/Lenovo-Service-Engine-LSE-BIOS-Vulnerability>
- <https://support.lenovo.com/us/en/product_security/lse_bios_desktop>
- <https://support.lenovo.com/us/en/product_security/lse_bios_notebook>