CVE-2022-27538

Summary of CVE-2022-27538 (HP BIOS TOCTOU): A TOCTOU vulnerability identified in the BIOS of certain HP PC products could allow arbitrary code execution, denial of service, and information disclosure. The impact and affected component are stated as BIOS-level for HP PCs, with a local attack vecto...

CVE-2022-37019

CVE-2022-37019 describes potential stack overflow/privilege-escalation vulnerabilities in HP PC BIOS that may enable code execution locally. HP has released firmware updates (May 2024 security updates) to mitigate these issues, with affected HP PC platforms and corresponding SoftPaqs indicated in...

CVE-2022-31635

CVE-2022-31635 concerns TOCTOU vulnerabilities in the BIOS of certain HP PC products, potentially enabling arbitrary code execution, privilege escalation, denial of service, and information disclosure. The affected component is the HP PC BIOS, with impact described in public entries as high (loca...

CVE-2021-3439

The CVE-2021-3439 entry concerns a vulnerability in BIOS firmware of some HP Workstation products. Public sources indicate a potential flaw in the BIOS firmware that HP is mitigating with firmware updates. The NVD entry assigns a CVSS v3.1 base score of 7.8 (HIGH) with LOCAL attack vector, LOW at...

CVE-2019-18618

CVE-2019-18618 concerns the Synaptics VFS75xx fingerprint sensors with external flash. The firmware exposes an incorrect access control vulnerability that, on all versions prior to 2019-11-15, can let a local administrator or physical attacker access sensor data by injecting an unverified partiti...

CVE-2022-31636

CVE-2022-31636 pertains to TOCTOU vulnerabilities in the BIOS of certain HP PC products. The connected Red Hat advisory and Red Hat/HP synchronization describe a BIOS-level issue that could enable arbitrary code execution, privilege escalation, denial of service, and information disclosure. Impac...

CVE-2022-31638

CVE-2022-31638 corresponds to a TOCTOU vulnerability in the BIOS of certain HP PC products. The underlying issue could allow arbitrary code execution, privilege escalation, denial of service, and information disclosure when exploiting BIOS-time checks versus usage. The connected HP HPBIOS/HP BIOS...

CVE-2021-3808

The CVE-2021-3808 entry concerns potential security vulnerabilities in the BIOS (UEFI firmware) of HP PC products, which could allow arbitrary code execution. The connected sources indicate the issue resides in HP’s BIOS/UEFI firmware and that HP released firmware updates (HPSBHF03788 and related...

CVE-2021-3809

CVE-2021-3809 concerns potential security vulnerabilities in the BIOS/UEFI firmware of certain HP PC products that might allow arbitrary code execution. The available connected documents note HP is releasing firmware updates to mitigate these vulnerabilities, with HP’s May 2022 security update (H...

CVE-2022-31639

CVE-2022-31639 describes TOCTOU vulnerabilities in the BIOS of certain HP PC products that could permit arbitrary code execution, privilege escalation, denial of service, and information disclosure. The issue stems from BIOS TOCTOU conditions and affects HP PC BIOS in unspecified platforms. Publi...

CVE-2022-37018

CVE-2022-37018 concerns a potential vulnerability in the system BIOS on certain HP PC products that could allow privilege escalation and code execution. The issue is tied to the BIOS/firmware layer, with a high impact (confidentiality, integrity, availability all high) and a local attack vector w...

CVE-2022-27537

CVE-2022-27537 concerns HP PC BIOS vulnerabilities that could enable arbitrary code execution, privilege escalation, denial of service, and information disclosure. Connected sources indicate the issue affects HP system BIOS with mitigations in BIOS updates; HP documents list affected platforms an...

CVE-2022-31645

CVE-2022-31645 is described as a BIOS/SMM vulnerability affecting HP PC products, with potential for arbitrary code execution, privilege escalation, DoS, and information disclosure. Connected sources indicate root cause as memory corruption/out-of-bounds write in the System Management Mode (SMM) ...

CVE-2022-27541

CVE-2022-27541 concerns TOCTOU vulnerabilities in HP BIOS for certain HP PC products. The issue allows arbitrary code execution, denial of service, and information disclosure due to TOCTOU conditions in BIOS-level checks. Affected platforms are HP PC BIOS firmware; HP has issued mitigations via B...

CVE-2022-31644

CVE-2022-31644 affects HP PC BIOS firmware, with a root cause described as an SMM/UEFI vulnerability leading to memory corruption (out-of-bounds write) that could permit arbitrary code execution, privilege escalation, DoS, or information disclosure. HP has released mitigations via BIOS updates (m...

CVE-2022-37020

HP PC BIOS vulnerability (CVE-2022-37020) affects certain HP PC products where the BIOS can allow elevation of privileges and code execution. The issue is tied to the BIOS/firmware layer, with HP releasing May 2024 security updates and platform-specific SoftPaqs to mitigate the vulnerability. Con...

CVE-2019-16284

CVE-2019-16284 concerns a BIOS/firmware vulnerability in HP products where the EFI_BOOT_SERVICES structure can be overwritten to execute arbitrary SMM code, potentially leading to privilege escalation during boot. The Red Hat and NVD entries align with HP’s advisory (HP: C06456250), describing af...

CVE-2022-31646

CVE-2022-31646 concerns a vulnerability in the system BIOS of certain HP PC products. The affected component is the BIOS/firmware, with HP noting potential arbitrary code execution, privilege escalation, denial of service, and information disclosure. The CVE is referenced across multiple feeds (N...

CVE-2022-43777

CVE-2022-43777 describes a TOCTOU vulnerability in HP BIOS affecting HP PC products. The issue could allow arbitrary code execution, denial of service, and information disclosure via a TOCTOU flaw in the BIOS. Connected sources indicate HP released BIOS updates to mitigate the vulnerability, with...

CVE-2022-27539

CVE-2022-27539 describes a TOCTOU issue in HP BIOS for certain HP PC products. The vulnerability could enable arbitrary code execution, denial of service, and information disclosure due to timing window between checks and subsequent use of critical BIOS operations. HP’s HP PC BIOS February 2023 S...

CVE-2022-43778

CVE-2022-43778 describes TOCTOU vulnerabilities in HP BIOS firmware for certain HP PC products that may permit arbitrary code execution, denial of service, and information disclosure. The root cause is a TOCTOU issue in the BIOS timing checks. Impact is high (local attacker, high confidentiality/...

CVE-2022-31637

CVE-2022-31637 is a TOCTOU vulnerability identified in the BIOS of certain HP PC products. The Red Hat and NVD entries align with HP’s security advisory describing a BIOS-level issue that could allow arbitrary code execution, privilege escalation, denial of service, and information disclosure. HP...