Table of Contents
  • Home
  • /
  • Blog
  • /
  • How To Fix The 16 New LPE And ACE Vulnerabilities In HP BIOS
March 9, 2022

How To Fix The 16 New LPE And ACE Vulnerabilities In HP BIOS

How To Fix The 16 New Lpe And Ace Vulnerabilities In Hp Bios

Binarly, a well-known firmware security specialist, disclosed 16new LPE (Local Privilege escalation) and ACT (Arbitrary code execution) vulnerabilities in HP BIOS. All these vulnerabilities are considered high in severity since they have got a score from 7.5 to 8.8. Owners of HP devices should pay attention to These vulnerabilities. Since these vulnerabilities affect multiple HP products, including laptops, desktops, point-of-sale systems, and edge computing nodes, lets see How to Fix the 16 New LPE and ACE Vulnerabilities in HP BIOS in this post.

Summary Of The 16 New LPE And ECE Vulnerabilities In HP BIOS:

3 out of 16 vulnerabilities could be used to carry out Local Privilege escalation, and the remaining 13 vulnerabilities could be abused to perform arbitrary code injection attacks on the vulnerable devices.

These vulnerabilities in HP BIOS let attackers not just Implant persistent malware programs that survive operating system updates and re-installations but are also capable of bypassing UEFI Secure Boot, Intel Boot Guard, virtualization-based security, and endpoint security systems. Check out the page for more technical details.

CVE-2021-39297BRLY-2021-003DXE stack buffer overflow (arbitrary code execution)7.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2021-39298BRLY-2021-004SMM callout (privilege escalation)8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2021-39299BRLY-2021-005DXE stack buffer overflow (arbitrary code execution)7.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2021-39300BRLY-2021-006DXE stack overflow vulnerability (arbitrary code execution)7.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2021-39301BRLY-2021-007DXE stack overflow (arbitrary code execution)7.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-23924BRLY-2021-032SMM heap buffer overflow (arbitrary code execution)7.9CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
CVE-2022-23925BRLY-2021-033SMM memory corruption (arbitrary code execution)7.9CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
CVE-2022-23926BRLY-2021-034SMM memory corruption (arbitrary code execution)7.5CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-23927BRLY-2021-035SMM memory corruption (arbitrary code execution)7.3CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
CVE-2022-23928BRLY-2021-036SMM memory corruption (arbitrary code execution)7.2CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
CVE-2022-23929BRLY-2021-037SMM memory corruption (arbitrary code execution)7.2CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
CVE-2022-23930BRLY-2021-038SMM memory corruption (arbitrary code execution)7.9CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
CVE-2022-23931BRLY-2021-039SMM memory corruption (arbitrary code execution)7.9CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H
CVE-2022-23932BRLY-2021-040SMM callout (privilege escalation)8.2CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-23933BRLY-2021-041SMM callout (privilege escalation)8.2CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-23934BRLY-2021-042SMM memory corruption (arbitrary code execution)7.9CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:H

Devices Vulnerable To These Vulnerabilities:

There are multiple devices affected by these 16 new LPE and ACE vulnerabilities, such as laptops, desktops, point-of-sale systems, and edge computing nodes. The Vendor said it had identified affected platforms and corresponding SoftPaqs that fixed the first five vulnerabilities in the above list. HP has not concluded the list of devices affected for the remaining eleven vulnerabilities. See the updates here for more information.

How To Fix The 16 New LPE And ACE Vulnerabilities In HP BIOS?

The best solution to cope with security vulnerabilities is to keep your system up to date with the latest firmware and software.

How to Upgrade BIOS in HP Devices?

BIOS can be upgraded in four different ways. However, Upgrading the BIOS manually from Windows is the simplest and safe way. Please refer to this KB to know about the remaining procedure.

1. Update the BIOS using HP Image Assistant
2. Update the BIOS from within the BIOS
3. Update the BIOS manually from within Windows
3. Update the BIOS manually from a USB flash drive (outside of Windows)

Step 1: Collect the Product Name, Product Number, Processor Name, and System BIOS.

You can capture this information either from the HP System Utility or from Windows System Information.

To open HP System Utility: Press the fn and esc keys to open the HP System Information utility.
To Open Windows System Information: Type System Information in the taskbar search and hit the Enter key.

Step 2: Prepare your system for the BIOS upgrade.

1. Connect the Power card in the case of Laptops.
2. Close all the applications. No applications are supposed to be running during the BIOS update.
3. Disable the Anti-Virus, system security, and any other security application temporarily. In Windows, search for and open 
Security and Maintenance settings, and then click Security to access virus protection settings.
4. Disable BitLocker temporarily. In Windows, search for and open 
Manage Bitlocker. Click Suspend protection, and then click Yes.

Step 3: Download the BIOS update.

1. Open the HP Software and Driver Downloads page on your browser.
2. Choose your product. Or Let the tool auto-analyze your product.
3. Select BIOS and check for any available BIOS updates. Click 
Download. Note: If you dont see BIOS updates, that means no updates are available for your product.

  1. Execute the BIOS update file.

    Browse the file that you have downloaded. Execute it with a double-click on it.
    Click Yes on the User Account Control screen.

Step 4: Click Next in the Installation Window.
Step 5: Accept the License Agreement.

Select I accept the terms in the license agreement, and then click Next.

Step 6: Click Next on the HP BIOS Update and Recovery window.

Step 7: Select Update, and then click Next.

Step 8: Restart after update.

Click Restart Now to install the update.

Step 9: Initiate BIOS update.

Click Apply Update Now on the HP BIOS Update window.

Step 10: Waite until the update process gets completed.
Step 11: Complete the BIOS update process and restart the computer.
Step 12: This completes the BIOS update process.

We hope this post would help you know How to Fix the 16 New LPE and ACE Vulnerabilities in HP BIOS. Thanks for reading this threat post. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this. 

Arun KL

Arun KL is a cybersecurity professional with 15+ years of experience in IT infrastructure, cloud security, vulnerability management, Penetration Testing, security operations, and incident response. He is adept at designing and implementing robust security solutions to safeguard systems and data. Arun holds multiple industry certifications including CCNA, CCNA Security, RHCE, CEH, and AWS Security.

Recently added

Application Security

View All

Learn More About Cyber Security Security & Technology

“Knowledge Arsenal: Empowering Your Security Journey through Continuous Learning”

Cybersecurity All-in-One For Dummies - 1st Edition

"Cybersecurity All-in-One For Dummies" offers a comprehensive guide to securing personal and business digital assets from cyber threats, with actionable insights from industry experts.



View All

Learn Something New with Free Email subscription