CVE-2018-12208: Buffer Overflow
First published: Thu Mar 14 2019(Updated: )
Buffer overflow in HECI subsystem in Intel(R) CSME before versions 11.8.60, 11.11.60, 11.22.60 or 12.0.20 and Intel(R) TXE version before 3.1.60 or 4.0.10, or Intel(R) Server Platform Services before version 5.00.04.012 may allow an unauthenticated user to potentially execute arbitrary code via physical access.
Credit: secure@intel.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Intel Converged Security Management Engine Firmware | >=11.0<11.8.60 | |
| Intel Converged Security Management Engine Firmware | >=11.10<11.11.60 | |
| Intel Converged Security Management Engine Firmware | >=11.20<11.22.60 | |
| Intel Converged Security Management Engine Firmware | >=12.0.0<12.0.20 | |
| Intel Server Platform Services Firmware | <5.00.04.012 | |
| Intel Trusted Execution Engine Firmware | >=3.0<3.1.60 | |
| Intel Trusted Execution Engine Firmware | >=4.0<4.0.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-12208?
CVE-2018-12208 is a vulnerability that allows an unauthenticated user to potentially execute arbitrary code via a buffer overflow in the HECI subsystem in Intel(R) CSME, Intel(R) TXE, or Intel(R) Server Platform Services.
What is the severity of CVE-2018-12208?
CVE-2018-12208 has a severity score of 7.6 (High).
Which software products are affected by CVE-2018-12208?
CVE-2018-12208 affects Intel Converged Security Management Engine Firmware versions between 11.0 and 11.8.60, 11.10 and 11.11.60, 11.20 and 11.22.60, and 12.0.0 and 12.0.20, Intel Server Platform Services Firmware version up to 5.00.04.012, and Intel Trusted Execution Engine Firmware versions between 3.0 and 3.1.60, and 4.0 and 4.0.10.
How can an unauthenticated user exploit CVE-2018-12208?
An unauthenticated user can exploit CVE-2018-12208 by exploiting a buffer overflow in the HECI subsystem to potentially execute arbitrary code.
Are there any fixes or patches available for CVE-2018-12208?
Yes, please refer to the references provided for information on available fixes or patches for CVE-2018-12208.
- collector/nvd-index
- vendor/intel
- canonical/intel converged security management engine firmware
- version/intel converged security management engine firmware/11.0
- version/intel converged security management engine firmware/11.10
- version/intel converged security management engine firmware/11.20
- version/intel converged security management engine firmware/12.0.0
- canonical/intel server platform services firmware
- canonical/intel trusted execution engine firmware
- version/intel trusted execution engine firmware/3.0
- version/intel trusted execution engine firmware/4.0