HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up.
Severity
High
HP Reference
HPSBHF03809
Rev. 1
Release date
September 6, 2022
Last updated
September 6, 2022
Category
PC
Potential Security Impact
Privilege escalation
Relevant Common Vulnerabilities and Exposures (CVE) List
Optional: Reported by: Ammarit Thongthua, Sumedt Jitpukdebodin, and Krischat Thataristorai (Secure D Research team)
LIST OF CVE IDS
| CVE ID | Base Score | Base Vector | Vendor ID |
|---|
| CVE-2022-38395 | 8.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H | HP |
Learn more about CVSS 3.1 base metrics, which range from 0 to 10.
PSR-2021-0113
Resolution
HP strives to address all security issues with HP Support Assistant at best possible speed and make the latest version available with the fixes. HP recommends that customers update to the latest version of HP Support Assistant that includes fixes to above listed issues by turning on automatic updates in the HP Support Assistant settings. If the system has HP Support Assistant version 8x, HP advises that customers to upgrade to HP Support Assistant version 9 by going to the About section and checking for updates. If the system has HP Support Assistant version 9, HP recommends keeping Microsoft Store updates turned on so that the application is always kept up to date.
Alternately, customers can also get the latest version at
https://www.hp.com/go/hpsupportassistant.
HP recommends keeping your system up to date with the latest firmware and software.
Affected products
Identify the following affected products.
- HP Support Assistant versions earlier than 9.11.
- Fusion versions earlier than 1.38.2601.0.
Revision history
This document has been revised according to the information below.
LIST OF VERSIONS
| Version | Description | Date |
|---|
| 1 | Initial Release | September 6, 2022 |
