Cybersecurity researchers from the information security company Binarly have discovered 16 dangerous vulnerabilities in various implementations of the Unified Extensible Firmware Interface (UEFI) firmware affecting millions of HP corporate devices.
The problems received scores from 7.5 to 8.8 points on the CVSS scale. Affected devices include HP laptops, personal computers, PoS terminals and edge computing nodes.
Attackers can exploit vulnerabilities to execute code in embedded software and potentially install persistent malicious code that will “survive” when reinstalling the operating system and will bypass endpoint protection solutions (EDR/AV), secure boot and Virtualization-Based Security component.
The most serious problems are related to memory corruption in the System Management Mode (SMM) firmware, which allows you to execute arbitrary code with the highest privileges.
The vulnerabilities were fixed as part of a series of security updates released on February 2 and 28, 2022.