HP finally fixes bug affecting hundreds of laptops and PC models

Hands typing on a keyboard surrounded by security icons
(Image credit: Shutterstock)

HP has released a series of updates aimed at addressing a number of potentially serious security flaws affecting a large number of its computing devices.

First detected in November 2021, the malware issues affect some of HP's most popular brands, including EliteBook notebooks, EliteDesk desktops and its Z1 and Z2 workstations.

The flaws, tracked as CVE-2021-3808 and CVE-2021-3809 and given a high severity rating, could have allowed hackers to gain access to victim devices and run code with Kernel privileges, potentially allowing them to execute any command at a Kernel level.


Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/£10.99.

HP security worries

In a security advisory published on its website, HP noted that "potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities".

The company didn't go into any specific technical details regarding the issues, but is urging customers to download and update immediately. 

However, Nicholas Starke, the researcher who first discovered the flaws, outlined the potential effects that the issues may have had in a bit more detail.

“This vulnerability could allow an attacker executing with kernel-level privileges (CPL == 0) to escalate privileges to System Management Mode (SMM). Executing in SMM gives an attacker full privileges over the host to further carry out attacks,” Starke noted in a blog post.

He outlined how a vulnerable SMI handler can be triggered through the Windows kernel driver, with attackers able to trigger remote code execution after finding the memory address of the "LocateProtocol" function and overwriting it with malicious code.

They could then install malware that would be unremovable, even using antivirus platforms or an OS reinstall. 

Some HP models are able to resist such attacks, Starke added, with the company's HP Sure Start software able to detect such interference, shutting down the host and urging users to approve a system boot.

The news comes shortly after HP issued patches for four dangerous vulnerabilities affecting hundreds of its printers that could lead to remote code execution, data theft, or denial of service.

Via BleepingComputer

Mike Moore
Deputy Editor, TechRadar Pro

Mike Moore is Deputy Editor at TechRadar Pro. He has worked as a B2B and B2C tech journalist for nearly a decade, including at one of the UK's leading national newspapers and fellow Future title ITProPortal, and when he's not keeping track of all the latest enterprise and workplace trends, can most likely be found watching, following or taking part in some kind of sport.