CVE-2022-43779

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-43779
A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerability.

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://support.hp.com/us-en/document/ish_7394557-7394585-16/hpsbhf03829 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:hp:348_g4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:348_g4:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:hp:260_g2_desktop_mini_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:260_g2_desktop_mini:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:hp:218_pro_g5_mt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:218_pro_g5_mt:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:hp:260_g3_desktop_mini_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:260_g3_desktop_mini:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:hp:260_g4_desktop_mini_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:260_g4_desktop_mini:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:hp:280_g3_microtower_pc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:280_g3_microtower_pc:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:hp:280_g3_pci_microtower_pc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:280_g3_pci_microtower_pc:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:hp:288_pro_g3_microtower_pc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:288_pro_g3_microtower_pc:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:hp:290_g1_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:290_g1_microtower:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:hp:desktop_pro_300_g3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_300_g3:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:hp:desktop_pro_a_300_g3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_300_g3:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:hp:desktop_pro_a_g2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_g2:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:hp:desktop_pro_a_g2_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_g2_microtower:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:hp:desktop_pro_a_g3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_g3:-:*:*:*:*:*:*:*

Configuration 15 (hide)

AND
cpe:2.3:o:hp:desktop_pro_a_g3_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_g3_microtower:-:*:*:*:*:*:*:*

Configuration 16 (hide)

AND
cpe:2.3:o:hp:desktop_pro_g3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_g3:-:*:*:*:*:*:*:*

Configuration 17 (hide)

AND
cpe:2.3:o:hp:desktop_pro_g3_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_g3_microtower:-:*:*:*:*:*:*:*

Configuration 18 (hide)

AND
cpe:2.3:o:hp:desktop_pro_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_microtower:-:*:*:*:*:*:*:*

Configuration 19 (hide)

AND
cpe:2.3:o:hp:zhan_66_pro_a_g1_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:zhan_66_pro_a_g1_microtower:-:*:*:*:*:*:*:*

Configuration 20 (hide)

AND
cpe:2.3:o:hp:zhan_66_pro_a_g1_r_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:zhan_66_pro_a_g1_r_microtower:-:*:*:*:*:*:*:*

Configuration 21 (hide)

AND
cpe:2.3:o:hp:zhan_66_pro_g1_r_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:zhan_66_pro_g1_r_microtower:-:*:*:*:*:*:*:*

Configuration 22 (hide)

AND
cpe:2.3:o:hp:zhan_86_pro_g1_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:zhan_86_pro_g1_microtower:-:*:*:*:*:*:*:*

Configuration 23 (hide)

AND
cpe:2.3:o:hp:rp2_retail_system_2000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:rp2_retail_system_2000:-:*:*:*:*:*:*:*

Configuration 24 (hide)

AND
cpe:2.3:o:hp:rp2_retail_system_2020_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:rp2_retail_system_2020:-:*:*:*:*:*:*:*

Configuration 25 (hide)

AND
cpe:2.3:o:hp:rp2_retail_system_2030_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:rp2_retail_system_2030:-:*:*:*:*:*:*:*
History

21 Feb 2023, 21:15

Type Values Removed Values Added
First Time Hp rp2 Retail System 2000 Firmware
Hp 260 G2 Desktop Mini
Hp rp2 Retail System 2020 Firmware
Hp zhan 66 Pro A G1 R Microtower
Hp 280 G3 Pci Microtower Pc Firmware
Hp desktop Pro A 300 G3
Hp desktop Pro G3 Microtower Firmware
Hp desktop Pro G3 Microtower
Hp desktop Pro A G3 Microtower
Hp 260 G4 Desktop Mini
Hp 288 Pro G3 Microtower Pc Firmware
Hp desktop Pro A G2 Microtower Firmware
Hp desktop Pro G3 Firmware
Hp desktop Pro A G2 Microtower
Hp desktop Pro Microtower
Hp desktop Pro A G3
Hp desktop Pro A G2 Firmware
Hp 348 G4
Hp zhan 86 Pro G1 Microtower Firmware
Hp desktop Pro A 300 G3 Firmware
Hp 290 G1 Microtower
Hp 290 G1 Microtower Firmware
Hp rp2 Retail System 2020
Hp zhan 66 Pro A G1 Microtower
Hp rp2 Retail System 2030
Hp 280 G3 Microtower Pc Firmware
Hp
Hp rp2 Retail System 2000
Hp 260 G3 Desktop Mini Firmware
Hp zhan 66 Pro A G1 R Microtower Firmware
Hp 260 G2 Desktop Mini Firmware
Hp zhan 66 Pro G1 R Microtower
Hp 280 G3 Pci Microtower Pc
Hp desktop Pro A G3 Microtower Firmware
Hp 260 G4 Desktop Mini Firmware
Hp 260 G3 Desktop Mini
Hp 218 Pro G5 Mt
Hp 348 G4 Firmware
Hp zhan 66 Pro G1 R Microtower Firmware
Hp 280 G3 Microtower Pc
Hp desktop Pro 300 G3
Hp desktop Pro A G3 Firmware
Hp zhan 66 Pro A G1 Microtower Firmware
Hp 288 Pro G3 Microtower Pc
Hp rp2 Retail System 2030 Firmware
Hp zhan 86 Pro G1 Microtower
Hp desktop Pro Microtower Firmware
Hp 218 Pro G5 Mt Firmware
Hp desktop Pro G3
Hp desktop Pro A G2
Hp desktop Pro 300 G3 Firmware
CWE CWE-367
References (MISC) https://support.hp.com/us-en/document/ish_7394557-7394585-16/hpsbhf03829 - (MISC) https://support.hp.com/us-en/document/ish_7394557-7394585-16/hpsbhf03829 - Patch, Vendor Advisory
CPE cpe:2.3:h:hp:zhan_86_pro_g1_microtower:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:260_g4_desktop_mini_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_g2:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:rp2_retail_system_2030:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:280_g3_microtower_pc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:zhan_66_pro_a_g1_microtower:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_300_g3:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:280_g3_pci_microtower_pc:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:rp2_retail_system_2030_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:218_pro_g5_mt:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:288_pro_g3_microtower_pc:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:zhan_66_pro_a_g1_r_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_g3_microtower:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_a_300_g3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:348_g4:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_g3_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:zhan_86_pro_g1_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:288_pro_g3_microtower_pc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_g3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:260_g2_desktop_mini_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_a_g2_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:280_g3_pci_microtower_pc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:260_g3_desktop_mini_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:rp2_retail_system_2000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:260_g4_desktop_mini:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:zhan_66_pro_g1_r_microtower:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:rp2_retail_system_2020_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_a_g3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:218_pro_g5_mt_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_a_g3_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:280_g3_microtower_pc:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_300_g3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:rp2_retail_system_2020:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_g3:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:348_g4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_microtower:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_300_g3:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:290_g1_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:290_g1_microtower:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_g2_microtower:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:260_g3_desktop_mini:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:rp2_retail_system_2000:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:zhan_66_pro_a_g1_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:zhan_66_pro_a_g1_r_microtower:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:zhan_66_pro_g1_r_microtower_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_g3_microtower:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:desktop_pro_a_g3:-:*:*:*:*:*:*:*
cpe:2.3:h:hp:260_g2_desktop_mini:-:*:*:*:*:*:*:*
cpe:2.3:o:hp:desktop_pro_a_g2_firmware:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.0

12 Feb 2023, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-02-12 04:15

Updated : 2023-12-10 14:48

NVD link : CVE-2022-43779

Mitre link : CVE-2022-43779

CVE.ORG link : CVE-2022-43779

JSON object : View

Products Affected

hp

  • 288_pro_g3_microtower_pc
  • zhan_66_pro_g1_r_microtower_firmware
  • rp2_retail_system_2020_firmware
  • rp2_retail_system_2020
  • desktop_pro_300_g3_firmware
  • desktop_pro_a_g3_microtower
  • rp2_retail_system_2000
  • desktop_pro_g3
  • 260_g2_desktop_mini
  • desktop_pro_a_g2_microtower
  • desktop_pro_g3_microtower_firmware
  • desktop_pro_microtower_firmware
  • 280_g3_microtower_pc_firmware
  • 260_g3_desktop_mini_firmware
  • desktop_pro_300_g3
  • desktop_pro_a_300_g3_firmware
  • zhan_66_pro_a_g1_microtower_firmware
  • 280_g3_pci_microtower_pc
  • desktop_pro_a_g3_firmware
  • zhan_66_pro_a_g1_r_microtower
  • 260_g3_desktop_mini
  • zhan_66_pro_a_g1_microtower
  • zhan_86_pro_g1_microtower_firmware
  • 260_g2_desktop_mini_firmware
  • desktop_pro_a_300_g3
  • desktop_pro_a_g2_firmware
  • rp2_retail_system_2030
  • zhan_86_pro_g1_microtower
  • rp2_retail_system_2000_firmware
  • 218_pro_g5_mt_firmware
  • desktop_pro_g3_firmware
  • zhan_66_pro_a_g1_r_microtower_firmware
  • desktop_pro_g3_microtower
  • 348_g4_firmware
  • desktop_pro_a_g2_microtower_firmware
  • 290_g1_microtower_firmware
  • 288_pro_g3_microtower_pc_firmware
  • 260_g4_desktop_mini_firmware
  • 218_pro_g5_mt
  • rp2_retail_system_2030_firmware
  • desktop_pro_a_g3_microtower_firmware
  • desktop_pro_a_g3
  • desktop_pro_microtower
  • 280_g3_pci_microtower_pc_firmware
  • 280_g3_microtower_pc
  • desktop_pro_a_g2
  • 348_g4
  • zhan_66_pro_g1_r_microtower
  • 260_g4_desktop_mini
  • 290_g1_microtower
CWE
CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition