A vulnerability in HP ThinPro 8 and 9 has been revealed, which could permit attackers with physical access to thin clients to extract the LUKS disk-encryption key. This flaw impacts devices where LUKS2 encryption secures the operating system’s root partition, with the decryption key stored within the Trusted Platform Module (TPM).
Understanding the Vulnerability
This security issue arises because the TPM policy does not completely validate the software loaded during the boot process. This discovery was made by a security researcher who found that, although designed to avert data theft from storage drives, the TPM policy in these HP thin clients fails to account for certain boot components.
HP ThinPro utilizes a bespoke tool, known as hptc-tpm-tool, during startup. This tool, along with an initramfs script called unseal_key, retrieves the LUKS key from the TPM and hands it over to cryptsetup to unlock the encrypted partition.
Technical Details of the Flaw
The encryption flaw is linked to the TPM key being sealed to specific Platform Configuration Registers (PCRs): PCR 0, PCR 2, and PCR 4. These registers measure the BIOS firmware, option ROMs, UEFI drivers, and the GRUB bootloader binary but overlook the GRUB configuration, Linux kernel, and initramfs.
An attacker cannot replace the GRUB binary without changing PCR 4, which would prevent the key’s release. However, they can alter the unencrypted initramfs, including the script that unseals the key, without modifying the PCR values that the TPM checks.
Potential Consequences and Recommendations
Once modified, the initramfs can copy the unsealed LUKS key to the unencrypted BOOT partition without detection. As a result, the device boots normally, while the attacker can access the LUKS key later. This requires physical access and the capability to modify or remove the M.2 SATA storage device.
This vulnerability, confirmed on various HP thin clients, allows attackers to decrypt partitions and access critical data such as configuration settings, certificates, and passwords. It poses significant risks for organizations that might return, lose, resell, or dispose of thin clients without ensuring secure data destruction.
The flaw is rated with a CVSS score of 6.1, categorized as Medium due to its physical access requirement and the high impact on confidentiality and integrity. Despite Secure Boot being disabled by default, enabling it and setting a BIOS password might only slow down, but not fully prevent, potential attacks.
The issue was reported to HP on February 22, 2026, and a fix is under quality assurance. However, no official security bulletin or patch has been released. Organizations using HP ThinPro should consider devices potentially compromised until a complete fix is deployed.
