PT-2019-1628 · Intel · Intel Converged Security/Manageability Engine+1

Published 2019-03-12 · Updated 2019-04-23 · CVE-2018-12199

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel Converged Security and Manageability Engine (CSME) versions prior to 11.8.60, 11.11.60, 11.22.60, or 12.0.20 Intel Trusted Execution Engine (TXE) versions prior to 3.1.60 or 4.0.10

Description The issue is related to a buffer overflow in memory, which may allow an attacker to execute arbitrary code. This can potentially be exploited by a privileged user with physical access to the system.

Recommendations For Intel Converged Security and Manageability Engine (CSME) versions prior to 11.8.60, 11.11.60, 11.22.60, or 12.0.20, update to version 11.8.60, 11.11.60, 11.22.60, or 12.0.20 or later. For Intel Trusted Execution Engine (TXE) versions prior to 3.1.60 or 4.0.10, update to version 3.1.60, 4.0.10 or later. As a temporary workaround, consider restricting physical access to the system to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-01175

CVE-2018-12199

Affected Products

Intel Converged Security/Manageability Engine

Intel Trusted Execution Engine

References · 6

• https://osv.dev/vulnerability/CVE-2018-12199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12199 · Security Note
• https://intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00185.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01175 · Security Note
• https://security.netapp.com/advisory/ntap-20190318-0001 · Note
• https://intel.com/content/www/us/en/security-center/advisory/intel-sa-00185.html · Note