A security vulnerability has been identified in HP’s in-built software HP Support Assistant, that is present on all HP and Omen laptops and desktop computers. HP Support Assistant is pre-installed on all HP and Omen devices, so all users of these devices could be at risk. A security bulletin has been released this week by HP Customer Support to inform users about the security impact of this vulnerability, and how to update their devices to use the patched version of this software. 

 HP Support Assistant exists to perform diagnostic test, troubleshoot issues, and search for BIOS and driver updates. It uses HP Performance Tune-up to perform some of these functionalities, which is launched by Fusion. CVE-2022-38395 is an escalation of privileges vulnerability that occurs when Fusion launches the HP Performance Tune-up. Attackers can exploit this vulnerability by injecting malicious code into the dynamic link library (DLL) in a DLL hijacking attack. This allows them to elevate their privileges to those of the application being loaded, which in the case of HP Support Assistant is SYSTEM level privileges. Affected versions include HP Support Assistant versions earlier than 9.11, and Fusion versions earlier than 1.38.2601.0. 

 This vulnerability has been given a ‘high’ severity rating, and a CVSS base score of 8.2/10. An exploit of this vulnerability could result in arbitrary code being run on the device at the highest privilege level, however user interaction is required for attackers to gain initial access. Because of this, devices are likely to only be vulnerable to an exploit if the attackers have already established a presence on the device using malware or a Remote Access Trojan (RAT) tool. However, as there are many routes of initial access, all users should apply the available patches as soon as possible in order to maintain high security on their devices.  

 The latest version of HP Support Assistant can be updated here, https://www.hp.com/go/hpsupportassistant, or by using the Microsoft Store. Users who are currently running version 8x of HP Support Assistant need to update to version 9 in order to receive this patch. This can be done by going to the About section in the HP Support Assistant software itself and clicking Check for updates. HP advise that all users turn on automatic updates to keep their software up to date.