Serious Security Flaws Found in HP OMEN Gaming Desktops and Laptops

Millions of HP OMEN gaming laptops and desktops are exposed to attack by a very serious vulnerability that allows hackers to activate denial of service states or escalate privileges and disable security solutions.

Contents hide

1 Below is the list of affected models:

2 Notebook

3 Desktop PC

3.1 Related posts:

The security flaw (tracked as CVE-2021-3437) found in a driver used by OMEN Gaming Hub software that comes pre-installed on all HP OMEN desktops and notebooks.

CVE-2021-3437 is due to HP’s choice to use code partially copied from WinRing0.sys, an open source driver, which they used to build their own HpPortIox64.sys driver that the OMEN Gaming Hub software uses to read / write memory kernel settings, PCI configurations, IO ports, and Model Specific Registers (MSR).

Below is the list of affected models:

Notebook

HP Pavilion Gaming Laptop 15-dk2xx/ec2xx
HP Pavilion Gaming Laptop 16-a0xxx
OMEN by HP Laptop 15-ce0xx/ce1xx/dc0xxx/dc1xxx/dc2xxx/dh0xxx/dh1xxx
OMEN by HP Laptop 17-an0xx/an1xx/cb0xxx/cb1xxx
OMEN Laptop 15-ek0xxx/ek1xxx/en0xxx/en1xxx
OMEN X by HP 2S Laptop 15-dg0xxx
OMEN X by HP Laptop 17-ap0xx

Read This Now: Test - Lamptron FC5 v3|Specs | CPU | Hashrate

Desktop PC

HP ENVY TE01-0xxx/1xxx/2xxx
HP Pavilion Gaming TG01-0xxxa/1xxxa/0xxxi/1xxxi/2xxx
HP Pavilion TP01-0xxx/1xxx
HP ENVY TE01-2xxx
OMEN by HP 880-0xx/1xx/5xx
OMEN Desktop PC 30L GT13-0xxxa/0xxxi/1xxxi
OMEN Desktop PC 25L GT11-0xxxa/0xxxi
OMEN Desktop PC 25L GT12-0xxxa/0xxxi
OMEN 25L Desktop PC GT12-1000i
OMEN 25L Desktop PC GT11-1000i
OMEN X by HP P1000-0xx
OMEN by HP Obelisk 875-0xxx/1xxx
OMEN by HP 873-0xxx
OMEN X by HP 900-1xx/2xx

According to a SentinelOne post, the vulnerability in the driver could give access to the system to any user without privileges. “If this serious flaw is exploited, it could allow any user of the computer, even without privileges, to change those privileges and access the kernel”. Once inside, the attacker could overwrite any file and exchange it for malicious files, corrupt the system, and more.

HP was already aware of the problem and Omen Gaming Hub already has a patched update since July. The SentinelOne post now alerts any HP PC owner to protect themselves with the update.

Read This Now: DDR5 memory faces production problems in the wake of global chip shortages

Earlier this year, SentinelOne had found a 16-year-old flaw in drivers for HP, Xerox, and Samsung printers, as well as another 12-year-old flaw in Microsoft Defender Antivirus, which granted attackers administrator privileges.