Vulnerability-Lookup

BDU:2022-05267 (CVE-2022-31640)

Vulnerability from fstec – Published: 2022-08-24 – Updated: 2022-08-24 – View on bdu.fstec.ru Exploit publicly available Fixed

Title

Уязвимость реализации режима System Management Mode (SMM) системы BIOS микропрограммного обеспечения ноутбуков HP, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании

Summary

Уязвимость реализации режима System Management Mode (SMM) системы BIOS микропрограммного обеспечения ноутбуков HP связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код или вызвать отказ в обслуживании

Severity

6.0 (Medium) CVSS 2.0


                      
                        AV:L/AC:H/Au:S/C:C/I:C/A:C

7.5 (High) CVSS 3.0


                      
                        CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Timing and state manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-367 - Ситуация гонки Time-of-check Time-of-use (TOCTOU)

Aliases

CVE-2022-31640

References

2 references

URL
https://www.csoonline.com/article/3669876/new-exploits-can-bypass-secure-boot-a…
https://support.hp.com/us-en/document/ish_6662920-6662944-16/hpsbhf03805

Impacted products

49 products from 1 vendor

Vendors

HP Inc.

Products

HP Elite Dragonfly G2, HP Elite Dragonfly Max, HP Elite x2 G8 Tablet, HP EliteBook 830 G7, HP EliteBook 830 G8, HP EliteBook 835 G7, HP EliteBook 835 G8, HP EliteBook 840 Aero G8, HP EliteBook 840 G7, HP EliteBook 840 G8, HP EliteBook 845 G7, HP EliteBook 845 G8, HP EliteBook 850 G7, HP EliteBook 850 G8, HP EliteBook 855 G7, HP EliteBook 855 G8, HP EliteBook x360 1030 G7, HP EliteBook x360 1030 G8, HP EliteBook x360 1040 G7, HP EliteBook x360 1040 G8, HP EliteBook x360 830 G7, HP EliteBook x360 830 G8, HP ProBook 430 G8, HP ProBook 440 G8, HP ProBook 445 G8, HP ProBook 450 G8, HP ProBook 630 G8, HP ProBook 635 Aero G8, HP ProBook 640 G7, HP ProBook 640 G8, HP ProBook 650 G7, HP ProBook 650 G8, HP ProBook x360 11 G7 EE, HP ProBook x360 435 G8 Notebook PC, HP ZBook Create G7, HP ZBook Firefly 14 G7, HP ZBook Firefly 14 inch G8 Mobile Workstation PC, HP ZBook Firefly 15 G7, HP ZBook Firefly 15.6 inch G8 Mobile Workstation PC, HP ZBook Fury 15 G7, HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC, HP ZBook Fury 17 G7, HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC, HP ZBook Power 15.6 inch G8 Mobile Workstation PC, HP ZBook Power G7, HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC, HP ZBook Studio G7, HP ZHAN 66 Pro 14 G4 Notebook PC, HP ZHAN 66 Pro A 14 G4 Notebook PC

Versions

до 01.10.00 (HP Elite Dragonfly G2), до 01.10.00 (HP Elite Dragonfly Max), до 01.10.00 (HP Elite x2 G8 Tablet), до 01.10.00 (HP EliteBook 830 G7), до 01.10.00 (HP EliteBook 830 G8), до 01.10.00 (HP EliteBook 835 G7), до 01.10.00 (HP EliteBook 835 G8), до 01.10.00 (HP EliteBook 840 Aero G8), до 01.10.00 (HP EliteBook 840 G7), до 01.10.00 (HP EliteBook 840 G8), до 01.10.00 (HP EliteBook 845 G7), до 01.10.00 (HP EliteBook 845 G8), до 01.10.00 (HP EliteBook 850 G7), до 01.10.00 (HP EliteBook 850 G8), до 01.10.00 (HP EliteBook 855 G7), до 01.10.00 (HP EliteBook 855 G8), до 01.10.00 (HP EliteBook x360 1030 G7), до 01.10.00 (HP EliteBook x360 1030 G8), до 01.10.00 (HP EliteBook x360 1040 G7), до 01.10.00 (HP EliteBook x360 1040 G8), до 01.10.00 (HP EliteBook x360 830 G7), до 01.10.00 (HP EliteBook x360 830 G8), до 01.10.00 (HP ProBook 430 G8), до 01.10.00 (HP ProBook 440 G8), до 01.10.00 (HP ProBook 445 G8), до 01.10.00 (HP ProBook 450 G8), до 01.10.00 (HP ProBook 630 G8), до 01.10.00 (HP ProBook 635 Aero G8), до 01.10.00 (HP ProBook 640 G7), до 01.10.00 (HP ProBook 640 G8), до 01.10.00 (HP ProBook 650 G7), до 01.10.00 (HP ProBook 650 G8), до 01.10.00 (HP ProBook x360 11 G7 EE), до 01.10.00 (HP ProBook x360 435 G8 Notebook PC), до 01.10.00 (HP ZBook Create G7), до 01.10.00 (HP ZBook Firefly 14 G7), до 01.10.00 (HP ZBook Firefly 14 inch G8 Mobile Workstation PC), до 01.10.00 (HP ZBook Firefly 15 G7), до 01.10.00 (HP ZBook Firefly 15.6 inch G8 Mobile Workstation PC), до 01.10.00 (HP ZBook Fury 15 G7), до 01.10.00 (HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC), до 01.10.00 (HP ZBook Fury 17 G7), до 01.10.00 (HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC), до 01.10.00 (HP ZBook Power 15.6 inch G8 Mobile Workstation PC), до 01.10.00 (HP ZBook Power G7), до 01.10.00 (HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC), до 01.10.00 (HP ZBook Studio G7), до 01.10.00 (HP ZHAN 66 Pro 14 G4 Notebook PC), до 01.10.00 (HP ZHAN 66 Pro A 14 G4 Notebook PC)

Product types

Firmware

Mitigations

Использование рекомендаций: https://support.hp.com/us-en/document/ish_6662920-6662944-16/hpsbhf03805

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:H/Au:S/C:C/I:C/A:C",
  "CVSS 3.0": "AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "HP Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 01.10.00 (HP Elite Dragonfly G2), \u0434\u043e 01.10.00 (HP Elite Dragonfly Max), \u0434\u043e 01.10.00 (HP Elite x2 G8 Tablet), \u0434\u043e 01.10.00 (HP EliteBook 830 G7), \u0434\u043e 01.10.00 (HP EliteBook 830 G8), \u0434\u043e 01.10.00 (HP EliteBook 835 G7), \u0434\u043e 01.10.00 (HP EliteBook 835 G8), \u0434\u043e 01.10.00 (HP EliteBook 840 Aero G8), \u0434\u043e 01.10.00 (HP EliteBook 840 G7), \u0434\u043e 01.10.00 (HP EliteBook 840 G8), \u0434\u043e 01.10.00 (HP EliteBook 845 G7), \u0434\u043e 01.10.00 (HP EliteBook 845 G8), \u0434\u043e 01.10.00 (HP EliteBook 850 G7), \u0434\u043e 01.10.00 (HP EliteBook 850 G8), \u0434\u043e 01.10.00 (HP EliteBook 855 G7), \u0434\u043e 01.10.00 (HP EliteBook 855 G8), \u0434\u043e 01.10.00 (HP EliteBook x360 1030 G7), \u0434\u043e 01.10.00 (HP EliteBook x360 1030 G8), \u0434\u043e 01.10.00 (HP EliteBook x360 1040 G7), \u0434\u043e 01.10.00 (HP EliteBook x360 1040 G8), \u0434\u043e 01.10.00 (HP EliteBook x360 830 G7), \u0434\u043e 01.10.00 (HP EliteBook x360 830 G8), \u0434\u043e 01.10.00 (HP ProBook 430 G8), \u0434\u043e 01.10.00 (HP ProBook 440 G8), \u0434\u043e 01.10.00 (HP ProBook 445 G8), \u0434\u043e 01.10.00 (HP ProBook 450 G8), \u0434\u043e 01.10.00 (HP ProBook 630 G8), \u0434\u043e 01.10.00 (HP ProBook 635 Aero G8), \u0434\u043e 01.10.00 (HP ProBook 640 G7), \u0434\u043e 01.10.00 (HP ProBook 640 G8), \u0434\u043e 01.10.00 (HP ProBook 650 G7), \u0434\u043e 01.10.00 (HP ProBook 650 G8), \u0434\u043e 01.10.00 (HP ProBook x360 11 G7 EE), \u0434\u043e 01.10.00 (HP ProBook x360 435 G8 Notebook PC), \u0434\u043e 01.10.00 (HP ZBook Create G7), \u0434\u043e 01.10.00 (HP ZBook Firefly 14 G7), \u0434\u043e 01.10.00 (HP ZBook Firefly 14 inch G8 Mobile Workstation PC), \u0434\u043e 01.10.00 (HP ZBook Firefly 15 G7), \u0434\u043e 01.10.00 (HP ZBook Firefly 15.6 inch G8 Mobile Workstation PC), \u0434\u043e 01.10.00 (HP ZBook Fury 15 G7), \u0434\u043e 01.10.00 (HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC), \u0434\u043e 01.10.00 (HP ZBook Fury 17 G7), \u0434\u043e 01.10.00 (HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC), \u0434\u043e 01.10.00 (HP ZBook Power 15.6 inch G8 Mobile Workstation PC), \u0434\u043e 01.10.00 (HP ZBook Power G7), \u0434\u043e 01.10.00 (HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC), \u0434\u043e 01.10.00 (HP ZBook Studio G7), \u0434\u043e 01.10.00 (HP ZHAN 66 Pro 14 G4 Notebook PC), \u0434\u043e 01.10.00 (HP ZHAN 66 Pro A 14 G4 Notebook PC)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://support.hp.com/us-en/document/ish_6662920-6662944-16/hpsbhf03805",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "09.08.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.08.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "24.08.2022",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-05267",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-31640",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "HP Elite Dragonfly G2, HP Elite Dragonfly Max, HP Elite x2 G8 Tablet, HP EliteBook 830 G7, HP EliteBook 830 G8, HP EliteBook 835 G7, HP EliteBook 835 G8, HP EliteBook 840 Aero G8, HP EliteBook 840 G7, HP EliteBook 840 G8, HP EliteBook 845 G7, HP EliteBook 845 G8, HP EliteBook 850 G7, HP EliteBook 850 G8, HP EliteBook 855 G7, HP EliteBook 855 G8, HP EliteBook x360 1030 G7, HP EliteBook x360 1030 G8, HP EliteBook x360 1040 G7, HP EliteBook x360 1040 G8, HP EliteBook x360 830 G7, HP EliteBook x360 830 G8, HP ProBook 430 G8, HP ProBook 440 G8, HP ProBook 445 G8, HP ProBook 450 G8, HP ProBook 630 G8, HP ProBook 635 Aero G8, HP ProBook 640 G7, HP ProBook 640 G8, HP ProBook 650 G7, HP ProBook 650 G8, HP ProBook x360 11 G7 EE, HP ProBook x360 435 G8 Notebook PC, HP ZBook Create G7, HP ZBook Firefly 14 G7, HP ZBook Firefly 14 inch G8 Mobile Workstation PC, HP ZBook Firefly 15 G7, HP ZBook Firefly 15.6 inch G8 Mobile Workstation PC, HP ZBook Fury 15 G7, HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC, HP ZBook Fury 17 G7, HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC, HP ZBook Power 15.6 inch G8 Mobile Workstation PC, HP ZBook Power G7, HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC, HP ZBook Studio G7, HP ZHAN 66 Pro 14 G4 Notebook PC, HP ZHAN 66 Pro A 14 G4 Notebook PC",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 System Management Mode (SMM) \u0441\u0438\u0441\u0442\u0435\u043c\u044b BIOS \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 HP, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0421\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0433\u043e\u043d\u043a\u0438 Time-of-check Time-of-use (TOCTOU) (CWE-367)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0440\u0435\u0436\u0438\u043c\u0430 System Management Mode (SMM) \u0441\u0438\u0441\u0442\u0435\u043c\u044b BIOS \u043c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 HP \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043e\u0431\u0449\u0435\u0433\u043e \u0440\u0435\u0441\u0443\u0440\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u043e\u043a\u0430\u043c\u0438 \u0438 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435\u043c",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.csoonline.com/article/3669876/new-exploits-can-bypass-secure-boot-and-modern-uefi-security-protections.html\nhttps://support.hp.com/us-en/document/ish_6662920-6662944-16/hpsbhf03805",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041c\u0438\u043a\u0440\u043e\u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0439 \u043a\u043e\u0434",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-367",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CVE-2022-31640 (GCVE-0-2022-31640)

Vulnerability from cvelistv5 – Published: 2023-06-14 16:30 – Updated: 2024-12-30 15:31

Summary

Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-30 15:30 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

hp CNA under the mitre root

CNA scorecard C 75/100 over 35 records in the last 180 days details

References

1 reference

URL	Tags
https://support.hp.com/us-en/document/ish_6662920…

Impacted products

1 product

Vendor	Product	Version
HP Inc.	HP PC BIOS	Affected: See HP Security Bulletin reference for affected versions.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.137Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.hp.com/us-en/document/ish_6662920-6662944-16/hpsbhf03805"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-31640",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-30T15:30:55.730224Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-367",
                "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-30T15:31:00.364Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HP PC BIOS",
          "vendor": "HP Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "See HP Security Bulletin reference for affected versions."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-06-14T16:30:14.571Z",
        "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
        "shortName": "hp"
      },
      "references": [
        {
          "url": "https://support.hp.com/us-en/document/ish_6662920-6662944-16/hpsbhf03805"
        }
      ],
      "x_generator": {
        "engine": "cveClient/1.0.13"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
    "assignerShortName": "hp",
    "cveId": "CVE-2022-31640",
    "datePublished": "2023-06-14T16:30:14.571Z",
    "dateReserved": "2022-05-25T21:05:10.867Z",
    "dateUpdated": "2024-12-30T15:31:00.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted