CVE-2019-18619 is a critical vulnerability affecting Synaptics WBF drivers (all versions prior to 2019-11-15) used in HP and Lenovo products. It stems from incorrect parameter validation within the synaTee component, allowing a local user to execute arbitrary code within the SGX enclave by providing invalid pointers to specific APIs. This vulnerability carries a high CVSS score of 7.8, indicating a significant risk of compromising the confidentiality, integrity, and availability of enclave data. While no public exploits, Metasploit modules, or community discussions have been identified, its potential impact on secure enclaves warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.2.225.26CPE matchmatch criteria | cpe:2.3:o:synaptics:vfs75xx_firmware:5.2.225.26:*:*:*:*:*:*:* | ||
5.2.318.26CPE matchmatch criteria | cpe:2.3:o:synaptics:vfs75xx_firmware:5.2.318.26:*:*:*:*:*:*:* | ||
5.2.524.26CPE matchmatch criteria | cpe:2.3:o:synaptics:vfs75xx_firmware:5.2.524.26:*:*:*:*:*:*:* | ||
5.2.3530.26CPE matchmatch criteria | cpe:2.3:o:synaptics:vfs75xx_firmware:5.2.3530.26:*:*:*:*:*:*:* | ||
5.3.3539.26CPE matchmatch criteria | cpe:2.3:o:synaptics:vfs75xx_firmware:5.3.3539.26:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.