CVE-2018-12191

Bounds check in Kernel subsystem in Intel CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20, or Intel(R) Server Platform Services before versions 4.00.04.383 or SPS 4.01.02.174, or Intel(R) TXE before versions 3.1.60 or 4.0.10 may allow an unauthenticated user to potentially execute arbitrary code via physical access.

Score

CVSS 3.1 7.6 High

Status

Modified - secure@intel.com

Published

2019-03-14

Last modified

2024-09-16

Weaknesses

CWE-119

Affected products

• Converged Security Management Engine Firmware (Intel)
• Server Platform Services Firmware (Intel)
• Trusted Execution Engine Firmware (Intel)
• Intelr Csme (Intel Corporation)
• Server Platform Services (Intel Corporation)
• Trusted Execution Engine And Intelr Active Management Technology (Intel Corporation)

References

• https://security.netapp.com/advisory/ntap-20190318-0001/
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03914en_us
• https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html