CVE-2022-43779

Published: Feb 12, 2023Modified: Mar 25, 2025

7.0

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.0 / Impact: 5.9

Source: NVD

Description

A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerability.

Affected (25)

25 products

348 G4 Firmware

260 G2 Desktop Mini Firmware

218 Pro G5 Mt Firmware

260 G3 Desktop Mini Firmware

260 G4 Desktop Mini Firmware

280 G3 Microtower Pc Firmware

280 G3 Pci Microtower Pc Firmware

288 Pro G3 Microtower Pc Firmware

290 G1 Microtower Firmware

Desktop Pro 300 G3 Firmware

Desktop Pro A 300 G3 Firmware

Desktop Pro A G2 Firmware

Desktop Pro A G2 Microtower Firmware

Desktop Pro A G3 Firmware

Desktop Pro A G3 Microtower Firmware

Desktop Pro G3 Firmware

Desktop Pro G3 Microtower Firmware

Desktop Pro Microtower Firmware

Zhan 66 Pro A G1 Microtower Firmware

Zhan 66 Pro A G1 R Microtower Firmware

Zhan 66 Pro G1 R Microtower Firmware

Zhan 86 Pro G1 Microtower Firmware

Rp2 Retail System 2000 Firmware

Rp2 Retail System 2020 Firmware

Rp2 Retail System 2030 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 348 G4 Firmware	Before f.65

Running on/with	Platform Versions
Hp 348 G4	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 260 G2 Desktop Mini Firmware	Before 2.26

Running on/with	Platform Versions
Hp 260 G2 Desktop Mini	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 218 Pro G5 Mt Firmware	Before f15

Running on/with	Platform Versions
Hp 218 Pro G5 Mt	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 260 G3 Desktop Mini Firmware	Before 02.20.00

Running on/with	Platform Versions
Hp 260 G3 Desktop Mini	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 260 G4 Desktop Mini Firmware	Before 02.12.00

Running on/with	Platform Versions
Hp 260 G4 Desktop Mini	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 280 G3 Microtower Pc Firmware	Before 02.02.40

Running on/with	Platform Versions
Hp 280 G3 Microtower Pc	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 280 G3 Pci Microtower Pc Firmware	Before 02.02.40

Running on/with	Platform Versions
Hp 280 G3 Pci Microtower Pc	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 288 Pro G3 Microtower Pc Firmware	Before 00.02.40

Running on/with	Platform Versions
Hp 288 Pro G3 Microtower Pc	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp 290 G1 Microtower Firmware	Before 00.02.40

Running on/with	Platform Versions
Hp 290 G1 Microtower	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro 300 G3 Firmware	Before f15

Running on/with	Platform Versions
Hp Desktop Pro 300 G3	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro A 300 G3 Firmware	Before f12

Running on/with	Platform Versions
Hp Desktop Pro A 300 G3	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro A G2 Firmware	Before f.11

Running on/with	Platform Versions
Hp Desktop Pro A G2	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro A G2 Microtower Firmware	Before f.11

Running on/with	Platform Versions
Hp Desktop Pro A G2 Microtower	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro A G3 Firmware	Before f12

Running on/with	Platform Versions
Hp Desktop Pro A G3	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro A G3 Microtower Firmware	Before f12

Running on/with	Platform Versions
Hp Desktop Pro A G3 Microtower	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro G3 Firmware	Before f15

Running on/with	Platform Versions
Hp Desktop Pro G3	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro G3 Microtower Firmware	Before f15

Running on/with	Platform Versions
Hp Desktop Pro G3 Microtower	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Desktop Pro Microtower Firmware	Before 00.02.40

Running on/with	Platform Versions
Hp Desktop Pro Microtower	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Zhan 66 Pro A G1 Microtower Firmware	Before f.11

Running on/with	Platform Versions
Hp Zhan 66 Pro A G1 Microtower	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Zhan 66 Pro A G1 R Microtower Firmware	Before f12

Running on/with	Platform Versions
Hp Zhan 66 Pro A G1 R Microtower	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Zhan 66 Pro G1 R Microtower Firmware	Before f15

Running on/with	Platform Versions
Hp Zhan 66 Pro G1 R Microtower	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Zhan 86 Pro G1 Microtower Firmware	Before 00.02.40

Running on/with	Platform Versions
Hp Zhan 86 Pro G1 Microtower	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Rp2 Retail System 2000 Firmware	Before 2.24

Running on/with	Platform Versions
Hp Rp2 Retail System 2000	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Rp2 Retail System 2020 Firmware	Before 2.24

Running on/with	Platform Versions
Hp Rp2 Retail System 2020	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hp Rp2 Retail System 2030 Firmware	Before 2.24

Running on/with	Platform Versions
Hp Rp2 Retail System 2030	All versions

Related CWEs

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

References (2)

https://support.hp.com/us-en/document/ish_7394557-7394585-16/hpsbhf03829

Source: hp-security-alert@hp.com

PatchVendor Advisory

https://support.hp.com/us-en/document/ish_7394557-7394585-16/hpsbhf03829

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.