CVE-2022-37018: HP Z1 G3 BIOS Privilege Escalation Flaw

CVE-2022-37018 Overview

A privilege escalation and code execution vulnerability has been identified in the system BIOS for certain HP PC products. This firmware-level security flaw allows attackers with local access to escalate privileges and execute arbitrary code at the BIOS level, potentially compromising the entire system before the operating system even loads. HP has acknowledged the vulnerability and released firmware updates to address the security issue.

Critical Impact

Successful exploitation could allow attackers to execute arbitrary code with elevated privileges at the BIOS level, potentially compromising system integrity, confidentiality, and availability while bypassing operating system security controls.

Affected Products

• HP EliteBook Series (820, 828, 840, 848, 850, 1030, 1040, X360 models - G1 through G4 generations)
• HP ProBook Series (430, 440, 446, 450, 470, 640, 650 - G2 through G4 generations)
• HP ZBook Workstation Series (14u, 15, 15u, 17, Studio - G3 and G4 generations)
• HP EliteDesk 800 Desktop Mini PC Series (35W/65W G2 and G3 models)
• HP ProDesk Series (400, 480, 600, 680 - G2 through G4 generations)
• HP ProOne All-in-One Series (400, 480, 600 - G2 and G3 generations)
• HP Z Workstation Series (Z1 G3, Z2 Mini G3, Z238, Z240)
• HP Elite Slice, Elite X2 1012, Pro X2 612 G2
• HP Retail Systems (Engage One AIO, MP9 G2, RP9 G1)

Discovery Timeline

• December 12, 2022 - CVE-2022-37018 published to NVD
• April 29, 2025 - Last updated in NVD database

Technical Details for CVE-2022-37018

Vulnerability Analysis

This BIOS-level vulnerability enables local privilege escalation and arbitrary code execution on affected HP PC products. The attack requires local access to the target system but does not require any user privileges or user interaction, making it exploitable by any local user or process that gains initial access to the machine.

The vulnerability resides in the system BIOS firmware, which operates at a privileged level below the operating system. Because BIOS executes before any OS-level security controls are loaded, successful exploitation can completely bypass security software, endpoint detection tools, and operating system access controls. An attacker exploiting this vulnerability could achieve persistent compromise that survives operating system reinstallation.

The weakness is associated with CWE-276 (Incorrect Default Permissions), suggesting that improper permission configurations in the BIOS allow unauthorized code execution or privilege escalation. The broad impact includes potential compromise of confidentiality, integrity, and availability of the affected systems.

Root Cause

The vulnerability stems from incorrect default permissions (CWE-276) in the HP system BIOS firmware. This misconfiguration allows local attackers to escalate their privileges without requiring authentication or elevated permissions. The firmware fails to properly validate or restrict access to sensitive BIOS functions, enabling unauthorized code execution at the firmware level.

Attack Vector

The attack vector is local, meaning an attacker must have some form of access to the target system to exploit the vulnerability. However, the attack complexity is low, and no special privileges or user interaction are required. The attack scenario involves:

1. An attacker gains local access to an affected HP PC system
2. The attacker interacts with the vulnerable BIOS firmware through local interfaces
3. Due to incorrect permission handling, the attacker can escalate privileges
4. The attacker achieves arbitrary code execution at the BIOS level
5. This provides persistent, low-level access that bypasses OS security controls

Since the vulnerability exists at the firmware level, exploitation could potentially enable bootkits, BIOS rootkits, or other persistent implants that are extremely difficult to detect and remove.

Detection Methods for CVE-2022-37018

Indicators of Compromise

• Unexpected changes to BIOS settings or configuration that were not authorized by system administrators
• Anomalous BIOS firmware versions that do not match approved corporate images or HP's official releases
• System boot behavior anomalies such as increased boot times or unexpected BIOS messages
• Evidence of BIOS reflashing or firmware modification in system event logs

Detection Strategies

• Implement BIOS/firmware integrity monitoring using HP Sure Start or equivalent firmware verification technologies
• Deploy endpoint detection solutions capable of monitoring firmware-level changes and boot process integrity
• Conduct regular BIOS version audits across the fleet to identify systems running vulnerable firmware versions
• Monitor for unauthorized BIOS configuration changes using enterprise management tools

Monitoring Recommendations

• Enable BIOS event logging where supported and forward logs to centralized SIEM systems
• Implement Secure Boot and TPM-based measured boot to detect firmware tampering
• Establish baseline BIOS configurations and versions for all HP systems in the environment
• Schedule regular firmware compliance scans to ensure all systems are patched to secure versions

How to Mitigate CVE-2022-37018

Immediate Actions Required

• Inventory all HP PC products in the organization to identify systems affected by this vulnerability
• Download and apply the latest BIOS firmware updates from HP Support for all affected models immediately
• Prioritize patching for systems in sensitive environments or those accessible to multiple users
• Implement physical security controls to limit local access to affected systems until patching is complete

Patch Information

HP has released firmware updates to mitigate this vulnerability. Organizations should consult the HP Security Advisory (HPSBHF03820) for specific firmware versions and download links for each affected product. BIOS updates should be applied following HP's recommended procedures, which typically involve either Windows-based update utilities, HP BIOS Configuration Utility, or bootable media. Ensure systems are connected to reliable power during the update process to prevent firmware corruption.

Workarounds

• Restrict physical access to affected HP systems to authorized personnel only until firmware updates can be applied
• Enable BIOS Administrator passwords to prevent unauthorized BIOS configuration changes
• Configure HP Sure Start (where available) to detect and recover from unauthorized BIOS modifications
• Implement application whitelisting and endpoint protection to reduce the risk of local attackers gaining initial access

# BIOS Version Verification Commands
# Check current BIOS version on Windows
wmic bios get smbiosbiosversion

# Check BIOS version via PowerShell
Get-WmiObject -Class Win32_BIOS | Select-Object SMBIOSBIOSVersion, ReleaseDate

# Compare against HP Security Advisory HPSBHF03820 for patched versions