PT-2018-13405 · Ibm · System Management Module

Published 2018-11-27 · Updated 2019-10-03 · CVE-2018-16092

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions System Management Module (SMM) versions prior to 1.06

Description The issue concerns the collection of sensitive information by the FFDC feature in the SMM. This feature collects SMM system files, which include SMM user account credentials and the system shadow file, thus potentially exposing sensitive data.

Recommendations For versions prior to 1.06, consider disabling the FFDC feature until a patch is available to prevent the collection of sensitive information.

Fix

Related Identifiers

CVE-2018-16092

Affected Products

System Management Module

References · 3

• https://support.lenovo.com/us/en/solutions/LEN-24374 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16092 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16092 · Security Note