Lucene search

HP Product Security Response TeamHPSBHF03850

HistoryJun 20, 2023 - 12:00 a.m.

AMI UEFI Firmware June 2023 Security Update (TOCTOU)

2023-06-2000:00:00

HP Product Security Response Team

support.hp.com

toctou vulnerability

ami uefi firmware

hp pc products

arbitrary code execution

security update

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS), which might allow arbitrary code execution. AMI has released updates to mitigate the potential vulnerability.

AMI has released updates to mitigate the potential vulnerability. HP has identified affected platforms and corresponding SoftPaqs with minimum versions that mitigate the potential vulnerability. See the affected platforms listed below.

Affected configurations

Vulners

Node

hp_desktop_pc_m01-f0xxxRange<2.14

indusoftthin_clientRange<00.01.11

indusoftthin_clientRange<00.01.10

indusoftthin_clientRange<00.01.11

hp_14-cf3xxx\,_14t-cf300Range<F.22

hp_14-cg0xxx\,_14g-cg000Range<F.69

hp_14-cm1xxx\,_14z-cm100Range<F.69

hp_14-dk0xxxRange<F.69

hp_14-dk1xxx\,_14z-dk100Range<F.69

hp_14-dq0xxx\,_14t-dq000Range<F.28

hp_14-dq1xxx\,_14t-dq100Range<F.28

hp_14-dq2xxx\,_14t-dq200Range<F.31

hp_14-dq3xxx\,_14t-dq300Range<F.61

hp_14-dq4xxx\,_14t-dq400Range<F.31

hp_14-dq5xxx\,_14t-dq500Range<F.18

hp_14-ep0xxxRange<F.04

hp_14-fq0xxxRange<F.68

hp_14-fq1xxx\,_14z-fq100Range<F.30

hp_14-fq2xxx\,_14z-fq200Range<F.15

hp_14g-cx1xxxRange<F.69

hp_14-ma3xxx\,_14t-ma300Range<F.22

hp_14q-cg0xxxRange<F.69

hp_14q-cy1xxxRange<F.69

hp_14s-cf3xxxRange<F.22

hp_14s-cr3xxxRange<F.22

hp_14s-cs3xxxRange<F.22

hp_14s-dk0xxxRange<F.69

hp_14s-dk1xxxRange<F.69

hp_14s-dm0xxxRange<F.69

hp_14s-dm1xxxRange<F.69

hp_14s-dp0xxxRange<F.69

hp_14s-dp1xxxRange<F.69

hp_14s-dq0xxxRange<F.28

hp_14s-dq1xxxRange<F.28

hp_14s-dq2xxxRange<F.31

hp_14s-dq3xxxRange<F.61

hp_14s-dq4xxxRange<F.31

hp_14s-dq5xxxRange<F.18

hp_14s-dr0xxxRange<F.28

hp_14s-dr1xxxRange<F.28

hp_14s-dr2xxxRange<F.31

hp_14s-dr3xxxRange<F.61

hp_14s-dr4xxxRange<F.31

hp_14s-dr5xxxRange<F.18

hp_14s-dy0xxxRange<F.28

hp_14s-dy1xxxRange<F.28

hp_14s-dy2xxxRange<F.31

hp_14s-dy3xxxRange<F.61

hp_14s-dy4xxxRange<F.31

hp_14s-dy5xxxRange<F.18

hp_14s-ef0xxxRange<F.22

hp_14s-ef1xxxRange<F.19

hp_14s-er0xxxRange<F.22

hp_14s-er1xxxRange<F.19

hp_14s-es0xxxRange<F.22

hp_14s-es1xxxRange<F.19

hp_14s-fq0xxxRange<F.68

hp_14s-fq1xxxRange<F.30

hp_14s-fq2xxxRange<F.15

hp_14s-fr0xxxRange<F.68

hp_14s-fr1xxxRange<F.30

hp_14s-fr2xxxRange<F.15

hp_14s-fy0xxxRange<F.68

hp_14s-fy1xxxRange<F.30

hp_14s-fy2xxxRange<F.15

hp_15-dy0xxx\,_15t-dy000Range<F.28

hp_15-dy1xxx\,_15t-dy100Range<F.28

hp_15-dy2xxx\,_15t-dy200Range<F.31

hp_15-dy3xxx\,_15t-dy300Range<F.61

hp_15-dy4xxx\,_15t-dy400Range<F.31

hp_15-dy5xxx\,_15t-dy500Range<F.18

hp_15-ef0xxx\,_15z-ef000Range<F.68

hp_15-ef1xxx\,_15z-ef100Range<F.68

hp_15-ef2xxx\,_15z-ef200Range<F.30

hp_15-ef3xxx\,_15z-ef300Range<F.15

hp_15-fc0xxxRange<F.08

hp_15-fd0xxxRange<F.05

hp_15s-eq0xxxRange<F.68

hp_15s-eq1xxxRange<F.68

hp_15s-eq2xxxRange<F.30

hp_15s-eq3xxxRange<F.15

hp_15s-er0xxxRange<F.68

hp_15s-er1xxxRange<F.68

hp_15s-er2xxxRange<F.30

hp_15s-er3xxxRange<F.15

hp_15s-ey0xxxRange<F.68

hp_15s-ey1xxxRange<F.68

hp_15s-ey2xxxRange<F.30

hp_15s-ey3xxxRange<F.15

hp_15s-fq0xxxRange<F.28

hp_15s-fq1xxxRange<F.28

hp_15s-fq2xxxRange<F.31

hp_15s-fq3xxxRange<F.61

hp_15s-fq4xxxRange<F.31

hp_15s-fq5xxxRange<F.18

hp_15s-fr0xxxRange<F.28

hp_15s-fr1xxxRange<F.28

hp_15s-fr2xxxRange<F.31

hp_15s-fr3xxxRange<F.61

hp_15s-fr4xxxRange<F.31

hp_15s-fr5xxxRange<F.18

hp_15s-fy0xxxRange<F.28

hp_15s-fy1xxxRange<F.28

hp_15s-fy2xxxRange<F.31

hp_15s-fy3xxxRange<F.61

hp_15s-fy4xxxRange<F.31

hp_15s-fy5xxxRange<F.18

hp_17t-by300Range<F.22

hp_17t-by400Range<F.19

lynxlynxRange<F.64dev.17

hp_17z-ca100Range<F.64

hp_17z-ca200Range<F.64

hp_17z-ca300Range<F.64

hp_17t-cn100Range<F.25

hp_17t-by100Range<F.05

lynxlynxRange<F.02dev.17

hp_17g-cr3xxxRange<F.22

hp_17q-cs3xxxRange<F.22

hp_17s-cr2xxxRange<F.05

hp_17s-cr3xxxRange<F.02

hp_17s-cu2xxxRange<F.05

hp_17s-cu3xxxRange<F.02

hp_17s-cy2xxxRange<F.05

hp_17s-cy3xxxRange<F.02

hp_envy_15-ep0xxx\,_15t-ep000Range<F.11

hp_envy_15-ep1xxx\,_15t-ep100Range<F.14

hp_envy_15m-ep0xxxRange<F.11

hp_envy_x360_13m-ar0xxxRange<F.28

hp_envy_x360_15-ds0xxx\,_15z-ds000Range<F.27

hp_envy_x360_15-ds1xxx\,_15z-ds100Range<F.12

hp_envy_x360_15-eu0xxx\,_15z-eu000Range<F.25

hp_envy_x360_15-eu1xxxRange<F.05

hp_envy_x360_15m-ds0xxxRange<F.27

hp_envy_x360_15m-eu0xxxRange<F.25

hp_pavilion_x360_14-dh0xxx\,_14t-dh000Range<F.49

hp_pavilion_x360_14-dh1xxx\,_14t-dh100Range<F.39

hp_pavilion_x360_14-ek0xxx\,_14t-ek0xxxRange<F.14

hpomen_gaming_hubRange<F.33

hp_15-db1xxx\,_15z-db100Range<F.20

hpomen_gaming_hubRange<F.22

hpomen_gaming_hubRange<F.49

hpomen_gaming_hubRange<F.39

hp_14-dg0xxxRange< F.19

hp_pavilion_13z-be000Range<F.12

hp_pavilion_14-dv2xxx\,_14t-dv200Range<F.09

hp_pavilion_14-ec0xxx\,_14z-ec000Range<F.13

hp_pavilion_14-ec1xxx\,_14z-ec100Range<F.06

hp_pavilion_15-bc5xx\,_15t-bc500Range<F.19

hp_pavilion_15-cw1xxx\,_15z-cw100Range<F.51

hp_pavilion_15-eg2xxx\,_15t-eg200Range<F.12

hp_pavilion_15-eg3xxxRange<F.02

hp_pavilion_15-eh0xxx\,_15z-eh000Range<F.25

hp_pavilion_15-eh1xxxRange<F.25

hp_pavilion_15-eh2xxx\,_15z-eh200Range<F.06

hp_pavilion_15-eh3xxxRange<F.02

hp_pavilion_13z-be000Range<F.06

hp_pavilion_14-ec0xxxRange<F.17

hp_pavilion_14-ec1xxx\,_14z-ec100Range<F.30

hp_pavilion_15-cw1xxx\,_15z-cw100Range<F.24

hp_pavilion_15-cw1xxx\,_15z-cw100Range<F.18

hp_pavilion_590-a0xxxRange<F.26

hp_pavilion_x360_14-dw1xxx\,_14t-dw100Range<F.48

hp_pavilion_x360_14-dw2xxxRange<F.48

hp_pavilion_x360_14m-dw1xxxRange<F.48

hp_pavilion_x360_14q-dw1xxxRange<F.48

hp_spectre_pro_x360_g2Range<F.33

hp_spectre_x360_13t-ae000Range<F.19

hp_spectre_x360_14-ea0xxx\,_14t-ea000Range<F.30

hp_spectre_x360_14-ea2xxx\,_14t-ea200Range<F.30

hp_spectre_x360_15-eb0xxx\,_15t-eb000Range<F.17

hp_spectre_x360_15-eb1xxx\,_15t-eb100Range<F.13

hp_spectre_x360_13t-ae000Range<F.48

hp_spectre_x360_convertible_15-df0xxx\,_15t-df000Range<F.49

hp_spectre_x360_convertible_15-df1xxx\,_15t-df100Range<F.30

mini-streamshadow_stream_recorderRange<F.02

hpomen_gaming_hubRange< F.27

hp_15-ay0xx\,_15t-ay000Range< F.12

hpomen_gaming_hubRange<F.44

hpomen_gaming_hubRange<F.15

hpomen_gaming_hubRange<F.20

hp_14-ck0xxxRange<F.44

hp_14-ck1xxx\,_14t-ck100Range<F.15

hpomen_gaming_hubRange< F.13

hpomen_gaming_hubRange<F.17

hpomen_gaming_hubRange< F.20

hpomen_gaming_hubRange<F.16

hp_15-ay5xxRange<F.02

hp_m01-d0xxxRange<F.23

hp_m01-d1xxxRange<F.12

xenu_bydatavaultRange<F.17

xenu_bydatavaultRange<F.18

hp_240_g10Range<F.04

hp_245_g6Range<F.35

hp_245_g7Range<F.69

hp_245_pcRange<F.25

ipythonipython_notebookRange<F.69

hp_250_g10_pcRange<F.05

hp_240_g10Range<F.08

hp_349_g7Range<F.28

hp_470_g10Range<F.02

hp_470_g10_pcRange<F.05

hp_290_g2Range<F.24

vmwareworkstationRange<F.08

hp_envy_te01-0xxxRange<F.35

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.77

tekbasetekbase_all-in-oneRange<F.42

tekbasetekbase_all-in-oneRange<F.77

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.32

tekbasetekbase_all-in-oneRange<F.47

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.38

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.15

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.38

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.15

tekbasetekbase_all-in-oneRange<F.16

tekbasetekbase_all-in-oneRange<F.15

tekbasetekbase_all-in-oneRange<F.16

tekbasetekbase_all-in-oneRange<F.01

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.38

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.38

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.38

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.77

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.32

tekbasetekbase_all-in-oneRange<F.77

tekbasetekbase_all-in-oneRange<F.15

tekbasetekbase_all-in-oneRange<F.16

tekbasetekbase_all-in-oneRange<F.01

tekbasetekbase_all-in-oneRange<F.38

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.35

tekbasetekbase_all-in-oneRange<F.87

hp_envy_x360_15-cp0xxxRange<F.10

tekbasetekbase_all-in-oneRange<F.25

tekbasetekbase_all-in-oneRange<F.27

tekbasetekbase_all-in-oneRange<F.87

tekbasetekbase_all-in-oneRange<F.17

tekbasetekbase_all-in-oneRange<F.10

hp_envy_desktop_795-0xxxRange<F.50

hp_envy_te01-0xxxRange<F.35

hp_envy_te01-1xxxRange<F.46

hp_envy_te01-2xxxRange<F.20

hp_envy_te01-3xxxRange<F.15

hp_envy_te02-0xxxRange<F.30

hp_m01-d0xxxRange<F.36

hp_m01-d1xxxRange<F.35

hp_m01-f0xxxRange<F.36

hp_m01-f1xxxRange<F.35

hp_m01-f2xxxRange<F.15

hp_n01-f1xxxRange<F.15

hp_desktop_390-0xxxRange<F.25

hp_desktop_390-0xxxRange<F.24

hp_envy_desktop_te01-1xxxRange<F.14

hp_envy_desktop_te01-1xxxRange<F.18

hp_envy_desktop_te01-1xxxRange<F.14

hp_envy_desktop_te01-1xxxRange<F.18

hp_envy_desktop_te01-1xxxRange<F.14

hp_envy_desktop_te01-1xxxRange<F.18

hpomen_gaming_hubRange<F.33

hpomen_gaming_hubRange<F.38

hpomen_gaming_hubRange<F.25

hpomen_gaming_hubRange<F.24

tekbasetekbase_all-in-oneRange<F.42

tekbasetekbase_all-in-oneRange<F.15

tekbasetekbase_all-in-oneRange<F.54

tekbasetekbase_all-in-oneRange<F.18

tekbasetekbase_all-in-oneRange<F.54

tekbasetekbase_all-in-oneRange<F.18

tekbasetekbase_all-in-oneRange<F.42

tekbasetekbase_all-in-oneRange<F.32

tekbasetekbase_all-in-oneRange<F.42

tekbasetekbase_all-in-oneRange<F.15

tekbasetekbase_all-in-oneRange<F.54

tekbasetekbase_all-in-oneRange<F.18

tekbasetekbase_all-in-oneRange<F.54

tekbasetekbase_all-in-oneRange<F.18

tekbasetekbase_all-in-oneRange<F.32

tekbasetekbase_all-in-oneRange<F.11

hp_pavilion_desktop_590-a0xxxRange<F.50

hp_pavilion_desktop_590-a0xxxRange<F.47

hp_pavilion_desktop_590-p0xxxRange<F.50

hp_pavilion_desktop_590-p0xxxRange<F.47

hp_pavilion_desktop_595-p0xxxRange<F.50

hp_pavilion_desktop_595-p0xxxRange<F.47

hp_pavilion_tp01-0xxxRange<F.50

hp_pavilion_tp01-1xxxRange<F.46

hp_pavilion_tp01-2xxxRange<F.20

hp_pavilion_tp01-0xxxRange<F.35

hp_pavilion_tp01-1xxxRange<F.46

hp_pavilion_tp01-2xxxRange<F.20

hp_pavilion_tp01-3xxxRange<F.15

wave-aiwaveRange<F.97android

hp_pavilion_desktop_590-a0xxxRange<F.50

hp_pavilion_desktop_590-a0xxxRange<F.47

hp_pavilion_desktop_590-p0xxxRange<F.50

hp_pavilion_desktop_590-p0xxxRange<F.47

hp_pavilion_x360_11-ad0xxxRange<F.36

hp_pavilion_x360_11-ad1xxxRange<F.35

slimframeworkslimRange<F.36

slimframeworkslimRange<F.35

slimframeworkslimRange<F.15

slimframeworkslimRange<F.55

slimframeworkslimRange<F.15

bluemoonbackpackRange<F.28

hpomen_gaming_hubRange<F.30

hpomen_gaming_hubRange<F.41

hpomen_gaming_hubRange<F.40

hpomen_gaming_hubRange<F.41

hpomen_gaming_hubRange<F.15

hp_envy_te01-0xxxRange<F.15

hpstorageworks_p2000_g3_msaRange<F.45

hpstorageworks_p2000_g3_msaRange<F.47

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.43

tekbasetekbase_all-in-oneRange<F.45

tekbasetekbase_all-in-oneRange<F.43

hp_280_g6Range<F.50

hp_280_g6Range<F.36

hp_280_g6Range<F.35

hp_280_g6_microtowerRange<F.50

hp_280_g6Range<F.36

hp_280_g6Range<F.40

hp_280_g6Range<F.30

hp_280_g6Range<F.40

hp_280_g6_microtowerRange<F.30

hp_280_pro_g6_microtowerRange<F.50

hp_280_pro_g6_microtowerRange<F.30

toshibatece-studio-282_firmwareRange<F.36

toshibatece-studio-282_firmwareRange<F.40

hp_240_g6Range<F.40

hp_desktop_pro_microtowerRange<F.50

hp_288_g6Range<F.36

hp_288_g6Range<F.40

hp_288_pro_g6_microtowerRange<F.50

hp_290_g2Range<F.50

hp_290_g2Range<F.36

hp_290_g2Range<F.35

hp_290_g2_microtowerRange<F.50

hp_290_g2Range<F.36

hp_290_g2Range<F.40

hp_290_g2Range<F.30

hp_290_g2Range<F.40

hp_desktop_pro_microtowerRange<F.50

hp_280_pro_g6_microtowerRange<F.15

hp_290_g2Range<F.15

hp_desktop_pro_g2Range<F.15

hp_280_pro_g6_microtowerRange<F.15

hp_290_g2Range<F.15

hp_desktop_pro_g2Range<F.15

hp_proone_240_g10Range<F.01

hp_proone_240_g10Range<F.16

hp_probook_440_g6Range<F.42

hp_proone_240_g10Range<F.42

bluemoonbackpackRange<F.42

hp_290_g2_microtowerRange<F.50

hp_desktop_pro_microtowerRange<F.50

CPENameOperatorVersion
hp 260 g4 desktop mini pclt2.14
hp t430 thin clientlt00.01.11
hp t430 thin clientlt00.01.11
hp t628 thin clientlt00.01.10
hp t638 thin clientlt00.01.11
hp 14-cf3xxx, 14t-cf300ltF.22
hp 14-cg0xxx, 14g-cg000ltF.69
hp 14-cm1xxx, 14z-cm100ltF.69
hp 14-dk0xxxltF.69
hp 14-dk1xxx, 14z-dk100ltF.69

Name	Operator	Version
hp 260 g4 desktop mini pc	lt	2.14
hp t430 thin client	lt	00.01.11
hp t430 thin client	lt	00.01.11
hp t628 thin client	lt	00.01.10
hp t638 thin client	lt	00.01.11
hp 14-cf3xxx, 14t-cf300	lt	F.22
hp 14-cg0xxx, 14g-cg000	lt	F.69
hp 14-cm1xxx, 14z-cm100	lt	F.69
hp 14-dk0xxx	lt	F.69
hp 14-dk1xxx, 14z-dk100	lt	F.69

Rows per page:

1-10 of 4021

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for HPSBHF03850