github - ghsa-55w2-94jr-cc63

ghsa-55w2-94jr-cc63

Vulnerability from github

Published

2022-05-24 17:07

Modified

2022-05-24 17:07

Details

A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02).

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-18913"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-31T04:15:00Z",
    "severity": "HIGH"
  },
  "details": "A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02).",
  "id": "GHSA-55w2-94jr-cc63",
  "modified": "2022-05-24T17:07:50Z",
  "published": "2022-05-24T17:07:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18913"
    },
    {
      "type": "WEB",
      "url": "https://support.hp.com/us-en/document/c06549501"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2019-18913 (GCVE-0-2019-18913)

Vulnerability from cvelistv5

Published

2020-01-31 03:04

Modified

2024-08-05 02:02

Severity ?

CWE

Possible Arbitrary Code Execution, Denial of Service, Information Disclosure.

Summary

A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02).

References

►

URL

Tags

https://support.hp.com/us-en/document/c06549501

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	HP Inc.	HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection.	Version: Depends on platform. Prior to 01.04.02 Version: or prior to 02.04.01 Version: or prior to 02.04.02.

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T02:02:39.823Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hp.com/us-en/document/c06549501"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection.",
          "vendor": "HP Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "Depends on platform. Prior to 01.04.02"
            },
            {
              "status": "affected",
              "version": "or prior to 02.04.01"
            },
            {
              "status": "affected",
              "version": "or prior to 02.04.02."
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Possible Arbitrary Code Execution, Denial of Service, Information Disclosure.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-31T03:04:11",
        "orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
        "shortName": "hp"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hp.com/us-en/document/c06549501"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "hp-security-alert@hp.com",
          "ID": "CVE-2019-18913",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection.",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Depends on platform. Prior to 01.04.02"
                          },
                          {
                            "version_value": "or prior to 02.04.01"
                          },
                          {
                            "version_value": "or prior to 02.04.02."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "HP Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A potential security vulnerability with pre-boot DMA may allow unauthorized UEFI code execution using open-case attacks. This industry-wide issue requires physically accessing internal expansion slots with specialized hardware and software tools to modify UEFI code in memory. This affects HP Intel-based Business PCs that support Microsoft Windows 10 Kernel DMA protection. Affected versions depend on platform (prior to 01.04.02; or prior to 02.04.01; or prior to 02.04.02)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Possible Arbitrary Code Execution, Denial of Service, Information Disclosure."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.hp.com/us-en/document/c06549501",
              "refsource": "CONFIRM",
              "url": "https://support.hp.com/us-en/document/c06549501"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2",
    "assignerShortName": "hp",
    "cveId": "CVE-2019-18913",
    "datePublished": "2020-01-31T03:04:11",
    "dateReserved": "2019-11-12T00:00:00",
    "dateUpdated": "2024-08-05T02:02:39.823Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.