What’s Vulnerable › Vulnerabilities
CVE-2019-18619
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-07-22 · updated 2026-06-17
- Weakness: CWE-763
Description
Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all versions prior to 2019-11-15) allows a local user to execute arbitrary code in the enclave (that can compromise confidentiality of enclave data) via APIs that accept invalid pointers.
Affected products
- HP Envy - 13T-Ah100 Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy - 13T-Aq100 Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy - 17T-Bw000 Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy - 17T-Ce000 Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy - 17T-Ce100 Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 13-Ah0Xxx Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy 13-Ah1Xxx Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy 13-Aq0Xxx Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 13-Aq1Xxx Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 15-Cn0Xxx X360 Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy 15-Cn1Xxx X360 Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy 15-Dr0Xxx X360 (Validity Fps) Firmware: before 5.5.26.1102 — fixed in 5.5.26.1102
- HP Envy 15-Dr0Xxx X360 Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 15-Dr1Xxx X360 (Validity Fps) Firmware: before 5.5.26.1102 — fixed in 5.5.26.1102
- HP Envy 15-Dr1Xxx X360 Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 15M-Cn0Xxx X360 Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy 15M-Dr0Xxx X360 (Validity Fps) Firmware: before 5.5.26.1102 — fixed in 5.5.26.1102
- HP Envy 15M-Dr0Xxx X360 Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 15M-Dr1Xxx X360 (Validity Fps) Firmware: before 5.5.26.1102 — fixed in 5.5.26.1102
- HP Envy 15M-Dr1Xxx X360 Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 17-Bw0Xxx Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy 17-Ce0Xxx Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 17-Ce1Xxx Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 17M-Bw0Xxx Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy 17M-Ce0Xxx Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy 17M-Ce1Xxx Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy X360 - 15T-Cn000 Firmware: before 5.5.11.1093 — fixed in 5.5.11.1093
- HP Envy X360 - 15T-Dr000 (Validity Fps) Firmware: before 5.5.26.1102 — fixed in 5.5.26.1102
- HP Envy X360 - 15T-Dr000 Firmware: before 6.0.39.1111 — fixed in 6.0.39.1111
- HP Envy X360 - 15T-Dr100 (Validity Fps) Firmware: before 5.5.26.1102 — fixed in 5.5.26.1102
How to fix
Upgrade to a fixed version: HP Envy - 13T-Ah100 Firmware 5.5.11.1093; HP Envy - 13T-Aq100 Firmware 6.0.39.1111; HP Envy - 17T-Bw000 Firmware 5.5.11.1093; HP Envy - 17T-Ce000 Firmware 6.0.39.1111; HP Envy - 17T-Ce100 Firmware 6.0.39.1111; HP Envy 13-Ah0Xxx Firmware 5.5.11.1093; HP Envy 13-Ah1Xxx Firmware 5.5.11.1093; HP Envy 13-Aq0Xxx Firmware 6.0.39.1111; HP Envy 13-Aq1Xxx Firmware 6.0.39.1111; HP Envy 15-Cn0Xxx X360 Firmware 5.5.11.1093; HP Envy 15-Cn1Xxx X360 Firmware 5.5.11.1093; HP Envy 15-Dr0Xxx X360 (Validity Fps) Firmware 5.5.26.1102. Check the vendor advisory for mitigations.
References
- https://support.hp.com/hk-en/document/c06696568
- https://support.lenovo.com/us/en/product_security/LEN-31372
- https://www.synaptics.com/company/blog/
- https://www.synaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdf
- https://www.syssec.wiwi.uni-due.de/en/research/research-projects/analysis-of-tee-software/
- https://support.hp.com/hk-en/document/c06696568
- https://support.lenovo.com/us/en/product_security/LEN-31372
- https://www.synaptics.com/company/blog/
- https://www.synaptics.com/sites/default/files/fingerprint-driver-SGX-security-brief-2020-07-14.pdf
- https://www.syssec.wiwi.uni-due.de/en/research/research-projects/analysis-of-tee-software/
Get alerted when CVE-2019-18619 or the next vulnerability affects your stack