HP finally fixes bug affecting hundreds of laptops and PC models

Hands typing on a keyboard surrounded by security icons
(Image credit: Shutterstock)

HP has released a series of updates aimed at addressing a number of potentially serious security flaws affecting a large number of its computing devices.

First detected in November 2021, the malware issues affect some of HP's most popular brands, including EliteBook notebooks, EliteDesk desktops and its Z1 and Z2 workstations.

The flaws, tracked as CVE-2021-3808 and CVE-2021-3809 and given a high severity rating, could have allowed hackers to gain access to victim devices and run code with Kernel privileges, potentially allowing them to execute any command at a Kernel level.

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022end of this survey

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/£10.99.

HP security worries

In a security advisory published on its website, HP noted that "potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities".

The company didn't go into any specific technical details regarding the issues, but is urging customers to download and update immediately. 

However, Nicholas Starke, the researcher who first discovered the flaws, outlined the potential effects that the issues may have had in a bit more detail.

“This vulnerability could allow an attacker executing with kernel-level privileges (CPL == 0) to escalate privileges to System Management Mode (SMM). Executing in SMM gives an attacker full privileges over the host to further carry out attacks,” Starke noted in a blog post.

He outlined how a vulnerable SMI handler can be triggered through the Windows kernel driver, with attackers able to trigger remote code execution after finding the memory address of the "LocateProtocol" function and overwriting it with malicious code.

They could then install malware that would be unremovable, even using antivirus platforms or an OS reinstall. 

Some HP models are able to resist such attacks, Starke added, with the company's HP Sure Start software able to detect such interference, shutting down the host and urging users to approve a system boot.

The news comes shortly after HP issued patches for four dangerous vulnerabilities affecting hundreds of its printers that could lead to remote code execution, data theft, or denial of service.

Via BleepingComputer

TOPICS
Mike Moore
Deputy Editor, TechRadar Pro

Mike Moore is Deputy Editor at TechRadar Pro. He has worked as a B2B and B2C tech journalist for nearly a decade, including at one of the UK's leading national newspapers and fellow Future title ITProPortal, and when he's not keeping track of all the latest enterprise and workplace trends, can most likely be found watching, following or taking part in some kind of sport.

Read more
The best free firewall
Sophos hotfixes remote code execution vulnerabilities in Firewall
A person at a laptop with a cybersecure lock symbol floating above it.
Hackers are still using old Ivanti bugs to break into networks
MediaTek
MediaTek reveals host of security vulnerabilities, so patch now
Digital image of a lock.
Xerox printer security risk could let hackers sneak into your systems
A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
New UEFI Secure Boot flaw exposes systems to bootkits
The best free firewall
Palo Alto warns another major firewall hack has been detected
Latest in Pro
A hand reaching out to touch a futuristic rendering of an AI processor.
Driving innovation and reshaping the insurance landscape with AI
Hands typing on a keyboard surrounded by security icons
Outdated ID verification myths put businesses at risk
China
Chinese hackers targeting Juniper Networks routers, so patch now
Google Meet create custom backgrounds
More AI features are coming to Google Workspace
Mac Studio on a desk
I compared Apple's Mac Studio M3 Ultra with 10 Windows workstations and I am truly shocked by what I found
Google Chrome dark mode
Google updates Chrome extension rules to ban affiliate link injection without user action or benefit
Latest in News
Google Gemini Robotics
Gemini just got physical and you should prepare for a robot revolution
Lilo & Stitch Official Trailer
Stitch crashes into earth and steals our hearts with the first trailer for the live-action Lilo & Stitch
GTA 5
GTA Online publisher Take-Two is gunning for a black market that’s basically heaven for cheaters
Y2K cast looking shocked
Y2K has a streaming release date on Max, so you can witness the technology uprising at home
The Discovery+ homepage
Discovery+ just got a big update to its streaming app that makes it more like Max – here are 5 great new features to try
Two Android phones on a green and blue background showing Google Messages
Struggling with slow Google Messages photo transfers? Google says new update will make 'noticeable difference'