绕过Microsoft Windows 10基于虚拟化的安全性

合肥亮少

故障现象:

Lenovo 安全公告：LEN-8584

可能产生的影响：具有管理权限的攻击者绕过 Microsoft 基于虚拟化的安全措施。

严重性：中

影响范围：整个行业

概要描述：

2016 年 8 月召开的黑帽安全技术大会上披露的一个漏洞会影响 Microsoft Windows 10 中基于虚拟化的安全性，该漏洞使具有管理权限的攻击者可在系统进入睡眠状态后恢复时绕过这些保护措施。

解决方案:

您应如何保护自己：

将 BIOS 版本更新到适用于产品的最新版本。

对产品的影响：

有关详细信息，请参考以下内容。

台式机

台式机-一体机

IdeaPad

网络交换机 - 不受影响

存储 - 不受影响

System x -Lenovo- 不受影响

System x (IBM) - 不受影响

ThinkPad - 不受影响

ThinkServer - 不受影响

ThinkStation

其他信息和参考：

https://www.blackhat.com/us-16/briefings.html#analysis-of-the-attack-surface-of-windows-10-virtualization-based-security

修订历史记录：

修订版本	日期	描述
1.0	12/15/2016	初始版本

有关最新信息，请留意 Lenovo 关于您的设备和软件发布的更新和公告。本公告中提供的信息“按原样”提供，不作任何种类的任何担保或保证。Lenovo 保留随时更改或更新本公告的权利。

对产品的影响：

台式机

产品	状态	修复漏洞所需的最低版本	更新链接
Erazer X700 Desktop	不受影响	‐	‐
IdeaCentre 200	受影响	O2AKT13A	http://support.lenovo.com/downloads/DS105225
IdeaCentre 300-20IBR	不受影响	‐	‐
IdeaCentre 300S-11IBR	不受影响	‐	‐
IdeaCentre 700	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
IdeaCentre Stick	不受影响	‐	‐
Lenovo 63	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
Lenovo B2200	受影响	O07KT59A	http://support.lenovo.com/downloads/DS101339
Lenovo D5055	受影响	IRKT59A	http://support.lenovo.com/downloads/DS112847
Lenovo E50-00 Deskop	受影响	O07KT59A	http://support.lenovo.com/downloads/DS101339
Lenovo E50-05	受影响	O15KT25A	http://support.lenovo.com/downloads/DS101941
Lenovo G5010	不受影响	‐	‐
Lenovo H3000	受影响	O07KT59A	http://support.lenovo.com/downloads/DS101339
Lenovo H30-00 Desktop	受影响	O07KT59A	http://support.lenovo.com/downloads/DS101339
Lenovo H3005	受影响	O06KT39A	http://support.lenovo.com/downloads/DS105664
Lenovo H30-05 Desktop	受影响	O06KT39A	http://support.lenovo.com/downloads/DS105664
Lenovo H3050	受影响	IEKT40A	https://support.lenovo.com/olddownloads/DS101277
Lenovo H30-50 Desktop	受影响	IEKT40A	https://support.lenovo.com/olddownloads/DS101277
Lenovo H50-00 Desktop	受影响	O07KT59A	http://support.lenovo.com/downloads/DS101339
Lenovo H5005	受影响	O06KT39A	http://support.lenovo.com/downloads/DS105664
Lenovo H50-05 Desktop	受影响	O06KT39A	http://support.lenovo.com/downloads/DS105664
Lenovo H50-30g Desktop	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
Lenovo H5050	受影响	IEKT40A	https://support.lenovo.com/olddownloads/DS101277
Lenovo H50-50 Desktop	受影响	IEKT40A	https://support.lenovo.com/olddownloads/DS101277
Lenovo M2200	受影响	O07KT59A	http://support.lenovo.com/downloads/DS101339
Lenovo M4350 Desktop	受影响	F9KT58A	http://support.lenovo.com/downloads/DS031119
Lenovo M4360 ID	受影响	F9KT58A	http://support.lenovo.com/downloads/DS031119
Lenovo M4500	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
Lenovo M4500 ID	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
Lenovo M4550 ID	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
Lenovo S200	不受影响	‐	‐
Lenovo S500	受影响	M0KKT25A	http://support.lenovo.com/downloads/DS104529
ThinkCentre E73 (SFF)	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
ThinkCentre E73 (TWR)	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
ThinkCentre E73s	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
ThinkCentre E74	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
ThinkCentre E74s	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
ThinkCentre E79	受影响	M0LKT13A	http://support.lenovo.com/downloads/DS105456
ThinkCentre E93 (SFF)	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre E93 (TWR)	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre Edge 72	不受影响	‐	‐
ThinkCentre M3500q	受影响	FRKT47A	https://support.lenovo.com/olddownloads/ds101009
ThinkCentre M4350t/s	不受影响	‐	‐
ThinkCentre M4500k	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
ThinkCentre M4500q	受影响	FHKT68A	http://support.lenovo.com/downloads/DS038325
ThinkCentre M4500t/s	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
ThinkCentre M4600t/s	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
ThinkCentre M53 (Tiny)	受影响	FRKT47A	https://support.lenovo.com/olddownloads/ds101009
ThinkCentre M600	受影响	M00KT48A	http://support.lenovo.com/downloads/DS105134
ThinkCentre M6500t/s	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M6600	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
ThinkCentre M6600q	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
ThinkCentre M6600t/s	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
ThinkCentre M700	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
ThinkCentre M72e (Ivy)	不受影响	‐	‐
ThinkCentre M72e (PCI)	受影响	F9KT58A	http://support.lenovo.com/downloads/DS031119
ThinkCentre M72e (Tiny)	受影响	F4KT57A	http://support.lenovo.com/downloads/DS029184
ThinkCentre M73 (SFF)	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
ThinkCentre M73 (TWR)	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
ThinkCentre M73 Tiny	受影响	FHKT68A	http://support.lenovo.com/downloads/DS038325
ThinkCentre M73p	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M78（10BN、10BQ、10BR、10BS、10BT、10BU 型）	受影响	FNKT46A	http://support.lenovo.com/downloads/DS038364
ThinkCentre M79 (SFF)	受影响	M0LKT13A	http://support.lenovo.com/downloads/DS105456
ThinkCentre M79 (TWR)	受影响	M0LKT13A	http://support.lenovo.com/downloads/DS105456
ThinkCentre M800	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
ThinkCentre M83 (SFF)	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M83 (Tiny)	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M83 (TWR)	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M8500t/s	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M8600t/s	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
ThinkCentre M900	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
ThinkCentre M92	受影响	9SKT97A	http://support.lenovo.com/downloads/DS029265
ThinkCentre M92P	受影响	9SKT97A	http://support.lenovo.com/downloads/DS029265
ThinkCentre M93	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M93P (SFF)	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M93P (TWR)	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkCentre M93P Tiny	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
YANGTIAN AfH110	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
YANGTIAN AfH81	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
YANGTIAN AfQ150	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
YANGTIAN Mc Godavari	受影响	M0LKT13A	http://support.lenovo.com/downloads/DS105456
YANGTIAN Mc H110	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
YANGTIAN Mc H110 PCI	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
YANGTIAN Mc H81	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
YANGTIAN Me/We H110	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
YANGTIAN Mf/Wf H110 PCI	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
YANGTIAN Mf/Wf H110 PCI	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
YANGTIAN Mf/Wf H81 PCI	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
YANGTIAN Mf/Wf H81 PCI	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
YANGTIAN Ms/Ws H81	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
YANGTIAN Ms/Ws H81	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
YANGTIAN Tc/Wc H110 PCI	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
YANGTIAN Tc/Wc H110 PCI	受影响	M05KT61A	http://support.lenovo.com/downloads/DS111845
YANGTIAN TC/WCc H81 PCI	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324
YANGTIAN TC/WCc H81 PCI	受影响	FCKT80A	http://support.lenovo.com/downloads/DS038324

台式机--- 一体机

产品	状态	修复漏洞所需的最低版本	更新链接
IdeaCentre 510S-23ISU	受影响	O2EKT24A	http://support.lenovo.com/downloads/DS112911
Lenovo A540 All In One (Broadwell)	不受影响	‐	‐
Lenovo A740 All-In-One - BDW	不受影响	‐	‐
Lenovo B5030	受影响	O0BKT25A	http://support.lenovo.com/downloads/DS101243
Lenovo B50-30 All-In-One	受影响	O0BKT25A	http://support.lenovo.com/downloads/DS101243
Lenovo B50-30 Touch All-In-One	受影响	O0BKT25A	http://support.lenovo.com/downloads/DS101243
Lenovo B5035	受影响	O0AKT23A	http://support.lenovo.com/downloads/DS101270
Lenovo B5040	受影响	O0BKT25A	http://support.lenovo.com/downloads/DS101243
Lenovo C50-30 All-In-One	受影响	O1XKT13A	http://support.lenovo.com/downloads/DS104539
Lenovo C5030-non-Touch	受影响	O1XKT13A	http://support.lenovo.com/downloads/DS104539
Lenovo S200z	受影响	M09KT33A	http://support.lenovo.com/downloads/DS104822
ThinkCenter M700z	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCenter M800z	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCentre E73Z (AIO)	受影响	FGKT49A	http://support.lenovo.com/downloads/DS038323
ThinkCentre E74z	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCentre E93Z (AIO)	受影响	FFKT43A	http://support.lenovo.com/downloads/DS036668
ThinkCentre E93z FO	受影响	FEKT9BA	http://support.lenovo.com/downloads/DS036004
ThinkCentre Edge 62z	受影响	F8KT40A	http://support.lenovo.com/downloads/DS031473
ThinkCentre Edge 72z	受影响	F6KT44A	http://support.lenovo.com/downloads/DS029266
ThinkCentre Edge 92z	受影响	9XKT35A	http://support.lenovo.com/downloads/DS030110
ThinkCentre M62Z	受影响	FOKT46A	http://support.lenovo.com/downloads/DS030249
ThinkCentre M700z	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCentre M7200z	受影响	FGKT49A	http://support.lenovo.com/downloads/DS038323
ThinkCentre M7250z	受影响	FGKT49A	http://support.lenovo.com/downloads/DS038323
ThinkCentre M72z	受影响	F6KT44A	http://support.lenovo.com/downloads/DS029266
ThinkCentre M7300z	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCentre M73Z (AIO)	受影响	FGKT49A	http://support.lenovo.com/downloads/DS038323
ThinkCentre M800z	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCentre M8200z	受影响	FGKT49A	http://support.lenovo.com/downloads/DS038323
ThinkCentre M8250z	受影响	FGKT49A	http://support.lenovo.com/downloads/DS038323
ThinkCentre M8300z	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCentre M8350z	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCentre M83Z (AIO)	受影响	FVKT48A	http://support.lenovo.com/downloads/DS105630
ThinkCentre M900Z	受影响	FUKT44A	http://support.lenovo.com/downloads/ds105631
ThinkCentre M92Z	受影响	9BKT71A	http://support.lenovo.com/downloads/DS029443
ThinkCentre M9350z	受影响	FEKT9BA	http://support.lenovo.com/downloads/DS036004
ThinkCentre M93Z (AIO)	受影响	FEKT9BA	http://support.lenovo.com/downloads/DS036004
ThinkCentre M9500z	受影响	FUKT44A	http://support.lenovo.com/downloads/ds105631
ThinkCentre M9550z	受影响	FUKT44A	http://support.lenovo.com/downloads/ds105631
ThinkCentre X1 AIO	受影响	M0HKT32A	http://support.lenovo.com/downloads/DS112100
YANGTIAN S3040	受影响	FGKT49A	http://support.lenovo.com/downloads/DS038323
YANGTIAN S800	受影响	FFKT43A	http://support.lenovo.com/downloads/DS036668

IdeaPad

产品	状态	修复漏洞所需的最低版本	更新链接
110-15ACL	受影响	1QCN31WW	http://support.lenovo.com/downloads/DS112718
110-17ACL	受影响	1QCN31WW	http://support.lenovo.com/downloads/DS112718
500S-14ISK	不受影响
500S-15ISK	不受影响
700-15ISK	不受影响
700-17ISK	不受影响
700S-14ISK	不受影响
710S-13ISK	不受影响
B40-80	不受影响
B41-30	不受影响
B41-35	不受影响
B41-80	不受影响
B50-80	不受影响
B51-30	不受影响
B51-35	不受影响
B51-80	不受影响
B70-80	不受影响
E31-70	不受影响
E31-80	不受影响
E40-80	不受影响
E41-15	不受影响
E41-80	不受影响
E50-80	不受影响
E51-80	不受影响
Edge2 1580	不受影响
Flex 3-1130	不受影响
Flex 3-1435	不受影响
Flex 3-1470	不受影响
FLEX 3-1480	不受影响
Flex 3-1570	不受影响
FLEX 3-1580	不受影响
G40-80	不受影响
G40-80m	不受影响
G41-35	不受影响
G50-80	不受影响
G50-80 Touch	不受影响
G50-80m	不受影响
G51-35	不受影响
G70-35	不受影响
G70-80	不受影响
ideapad 100S-11IBY	不受影响
ideapad 100S-14IBR	不受影响
ideapad 300-14IBR	不受影响
ideapad 300-14ISK	不受影响
ideapad 300-15IBR	不受影响
ideapad 300-15ISK	不受影响
ideapad 300-17ISK	不受影响
ideapad 300S-11IBR	不受影响
ideapad 305-14IBD	不受影响
ideapad 305-15IBD	不受影响
ideapad 305-15IBY	不受影响
ideapad 500-15ACZ	不受影响
k20	不受影响
K41-70	不受影响
Lenovo ideapad 310-14ISK	不受影响
Lenovo ideapad 310-15ISK	不受影响
Lenovo ideapad 510-15 ISK	不受影响
Lenovo N22	不受影响
Lenovo Yoga 500-14IBD	不受影响
Lenovo Yoga 500-14ISK	不受影响
Lenovo Yoga 500-15IBD	不受影响
Lenovo Yoga 500-15ISK	不受影响
M41-70	不受影响
M41-80	不受影响
M51-80	不受影响
MIIX700-12ISK	不受影响
N22 Chromebook	不受影响
N41-80	不受影响
N51-80	不受影响
Nano B15	不受影响
RESCUER-14	不受影响
S41-35	不受影响
S41-75	不受影响
XiaoXin 310-14ISK	不受影响
XiaoXin Air 13	不受影响
Y700-14 ISK	不受影响
Y700-15ACZ	不受影响
Y700-15ISK	不受影响
Y700-15ISK 3D	不受影响
Y700-17ISK	不受影响
Y700Touch-15ISK	不受影响
Yoga 3 14	受影响	BACNA0WW	http://support.lenovo.com/ownloads/DS102769
Yoga 300-11IBR	不受影响
Yoga 700-11ISK	不受影响
Yoga 700-14	不受影响
Yoga 900	不受影响
YOGA 900S	不受影响
Z50-75	受影响	A4CN42WW	http://support.lenovo.com/downloads/DS100825
Z51-70	不受影响

ThinkStation

产品	状态	修复漏洞所需的最低版本	更新链接
ThinkStation C30（1095-1096-1097 型）	受影响	A1KT58A	http://support.lenovo.com/downloads/DS028464
ThinkStation C30（1136-1137 型）	受影响	A3KT57A	http://support.lenovo.com/downloads/DS035725
ThinkStation D30（4223-4228-4229 型）	受影响	A1KT58A	http://support.lenovo.com/downloads/DS028464
ThinkStation D30（4353-4354 型）	受影响	A3KT57A	http://support.lenovo.com/downloads/DS035725
ThinkStation E31	受影响	9SKT97A	http://support.lenovo.com/downloads/DS029265
ThinkStation E32	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkStation P300	受影响	FBKTC6A	https://support.lenovo.com/olddownloads/ds035753
ThinkStation P310	受影响	FWKT57A	http://support.lenovo.com/downloads/DS105487
ThinkStation P410	受影响	S00KT29A	http://support.lenovo.com/downloads/DS112673
ThinkStation P500	受影响	A4KT91A	http://support.lenovo.com/downloads/DS101230
ThinkStation P510	受影响	S00KT29A	http://support.lenovo.com/downloads/DS112673
ThinkStation P700	受影响	A5KT91A	http://support.lenovo.com/downloads/DS101343
ThinkStation P710	受影响	S01KT29A	http://support.lenovo.com/downloads/DS112674
ThinkStation P900	受影响	A6KT91A	http://support.lenovo.com/downloads/ds101344
ThinkStation P910	受影响	S02KT29A	http://support.lenovo.com/downloads/DS112675
ThinkStation S30（0567-0568-0569-0606 型）	受影响	A0KT58A	http://support.lenovo.com/downloads/DS028141
ThinkStation S30（4351-4352 型）	受影响	A2KT57A	http://support.lenovo.com/downloads/DS035724