HP has patched a serious vulnerability that is estimated to impact “millions of devices” including a wide variety of its Omen gaming laptops and desktops, as well as HP Pavilion and HP Envy models.
Researchers from SentinelLabs published details of the vulnerability, tracked as CVE-2021-3437, which can be exploited by threat actors to escalate privileges and disable security solutions, and conduct all kinds of malicious activities.
“This high severity vulnerability affects millions of PCs and users worldwide. While we haven’t seen any indicators that these vulnerabilities have been exploited in the wild up till now, using any Omen-branded PC with the vulnerable driver utilized by Omen Gaming Hub makes the user potentially vulnerable,” note the researchers.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
The vulnerability was responsibly disclosed to HP in February, 2021, but SentinelLabs hasn’t found any instances of it being exploited in the wild.
Inherited vulnerability
Parsing through the technical analysis, BleepingComputer reports that the vulnerability existed in the HP Omen Command Center, which helps gamers tweak the settings of their gaming machines.
The software can also be grabbed from the Microsoft Store for any Windows 10 PC that uses accessories sold under HP’s Omen brand, which further increases the number of potentially exploitable computers.
As per the researchers, the source of the bug is a driver that partially relies on the open source WinRing0.sys driver to help manage various low-level actions.
“The link between the two drivers can readily be seen as on some signed HP versions the metadata information shows the original filename and product name. Unfortunately, issues with the WinRing0.sys driver are well-known,” share the researchers.
HP first released patches for the vulnerability through the Microsoft Store on July 27, before publishing a security advisory to coincide with SentinelOne’s analysis.
Although the researchers haven’t spotted any exploits based on the vulnerability, they urge all impacted users to “ensure they take appropriate mitigating measures without delay.”
Via BleepingComputer
