HP finally fixes bug affecting hundreds of laptops and PC models

HP has released a series of updates aimed at addressing a number of potentially serious security flaws affecting a large number of its computing devices.

First detected in November 2021, the malware issues affect some of HP’s most popular brands, including EliteBook notebooks, EliteDesk desktops and its Z1 and Z2 workstations.

The flaws, tracked as CVE-2021-3808 and CVE-2021-3809 and given a high severity rating, could have allowed hackers to gain access to victim devices and run code with Kernel privileges, potentially allowing them to execute any command at a Kernel level.

HP security worries

In a security advisory published on its website, HP noted that “potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities”.

The company didn’t go into any specific technical details regarding the issues, but is urging customers to download and update immediately. 

However, Nicholas Starke, the researcher who first discovered the flaws, outlined the potential effects that the issues may have had in a bit more detail.

“This vulnerability could allow an attacker executing with kernel-level privileges (CPL == 0) to escalate privileges to System Management Mode (SMM). Executing in SMM gives an attacker full privileges over the host to further carry out attacks,” Starke noted in a blog post.

He outlined how a vulnerable SMI handler can be triggered through the Windows kernel driver, with attackers able to trigger remote code execution after finding the memory address of the “LocateProtocol” function and overwriting it with malicious code.

They could then install malware that would be unremovable, even using antivirus platforms or an OS reinstall. 

Some HP models are able to resist such attacks, Starke added, with the company’s HP Sure Start software able to detect such interference, shutting down the host and urging users to approve a system boot.

The news comes shortly after HP issued patches for four dangerous vulnerabilities affecting hundreds of its printers that could lead to remote code execution, data theft, or denial of service.

Via BleepingComputer