'Executing in SMM gives an attacker full privileges over the host to further carry out attacks.' 'This vulnerability could allow an attacker executing with kernel-level privileges (CPL = 0) to escalate privileges to System Management Mode (SMM),' Starke wrote. Here is my blog post with the technical details: (PSR-2021-0177 is mine)

I was not credited anywhere, despite being told by that I would be credited. I've been working on a vulnerability for six months and the advisory was just made public yesterday. That was left to security researcher Nicholas Starke, who discovered them but has not been credited by HP despite being told they would be. HP hasn't revealed any technical details about the vulnerabilities. The company has just released updates for more than 200 device models that fix two high-severity vulnerabilities in the UEFI Firmware.Īs reported by Bleeping Computer, HP has issued an advisory over potential security vulnerabilities that could allow arbitrary code execution with Kernel privileges, which would enable hackers to access to a device's BIOS and plant malware that can't be removed by traditional antivirus software or reinstalling the operating system.īoth the vulnerabilities-CVE-2021-3808 and CVE-2021-3809-have a high-severity CVSS 3.1 base score of 8.8. In brief: Do you own an HP laptop, desktop, or PoS PC? Then you might want to ensure its BIOS is up to date.

Update bios hp pavilion