CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2019-18619
Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
- CWE
- CWE-763
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hp:envy_-_13t-ah100_firmware
- hp:envy_-_13t-aq100_firmware
- hp:envy_-_17t-bw000_firmware
- hp:envy_-_17t-ce000_firmware
- hp:envy_-_17t-ce100_firmware
- hp:envy_13-ah0xxx_firmware
- hp:envy_13-ah1xxx_firmware
- hp:envy_13-aq0xxx_firmware
- hp:envy_13-aq1xxx_firmware
- hp:envy_15-cn0xxx_x360_firmware
- hp:envy_15-cn1xxx_x360_firmware
- hp:envy_15-dr0xxx_x360_\(validity_fps\)_firmware
- hp:envy_15-dr0xxx_x360_firmware
- hp:envy_15-dr1xxx_x360_\(validity_fps\)_firmware
- hp:envy_15-dr1xxx_x360_firmware
- hp:envy_15m-cn0xxx_x360_firmware
- hp:envy_15m-dr0xxx_x360_\(validity_fps\)_firmware
- hp:envy_15m-dr0xxx_x360_firmware
- hp:envy_15m-dr1xxx_x360_\(validity_fps\)_firmware
- hp:envy_15m-dr1xxx_x360_firmware
- hp:envy_17-bw0xxx_firmware
- hp:envy_17-ce0xxx_firmware
- hp:envy_17-ce1xxx_firmware
- hp:envy_17m-bw0xxx_firmware
- hp:envy_17m-ce0xxx_firmware
- hp:envy_17m-ce1xxx_firmware
- hp:envy_x360_-_15t-cn000_firmware
- hp:envy_x360_-_15t-dr000_\(validity_fps\)_firmware
- hp:envy_x360_-_15t-dr000_firmware
- hp:envy_x360_-_15t-dr100_\(validity_fps\)_firmware
- hp:envy_x360_-_15t-dr100_firmware
- hp:pavilion_14-cd1xxx_x360_firmware
- hp:pavilion_14-cd2xxx_x360_firmware
- hp:pavilion_14-dh0xxx_x360_firmware
- hp:pavilion_14m-cd0xxx_x360_firmware
- hp:pavilion_14m-dh0xxx_x360_firmware
- hp:pavilion_15_firmware
- hp:pavilion_x360_-_14t-cd000_firmware
- hp:pavilion_x360_-_15t-dq000_firmware
- hp:pavilion_x360_-_15t-dq100_firmware
- hp:pavilion_x360_14t-cd100_firmware
- hp:pavilion_x360_14t-dh000_firmware
- hp:spectre_x360_firmware
- lenovo:thankpad_a475_firmware
- lenovo:thankpad_a485_firmware
- lenovo:thinkpad_25_firmware
- lenovo:thinkpad_a275_firmware
- lenovo:thinkpad_e480_firmware
- lenovo:thinkpad_e485_firmware
- lenovo:thinkpad_e490_firmware
References
- https://support.hp.com/hk-en/document/c06696568
- https://support.lenovo.com/us/en/product_security/LEN-31372
- https://www.synaptics.com/company/blog/
- https://www.synaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdf
- https://www.syssec.wiwi.uni-due.de/en/research/research-projects/analysis-of-tee-software/