title: Security Vulnerability on Match-on-Chip FPR Architecture
description: ELAN Match-on-Chip FPR solution has design fault about potential risk of valid SID leakage and enumeration with spoof sensor.
This fault leads to that Windows Hello recognition would be bypass with cloning SID to cause broken account identity.
Version which is lower than 3.0.12011.08009(Legacy)/3.3.12011.08103(ESS) would suffer this risk on DELL Inspiron platform.
problem types: CWE-290 Authentication Bypass by Spoofing
affected:
{
defaultStatus: affected
modules: Windows Hello Identification
packageName: UMDF Driver
platforms: Windows
product: DELL Inspiron
vendor: ELAN
versions:
lessThan: 3.0.12011.08009, status: affected, version: 3.0.12011.08001, versionType: custom
lessThan: 3.3.12011.08103, status: affected, version: 3.3.12011.08101, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL