NVD Vulnerability Detail

CVE-2018-12147

Summary	Insufficient input validation in HECI subsystem in Intel(R) CSME before version 11.21.55, Intel® Server Platform Services before version 4.0 and Intel® Trusted Execution Engine Firmware before version 3.1.55 may allow a privileged user to potentially enable escalation of privileges via local access.
Publication Date	June 14, 2019, 1:29 a.m.
Registration Date	March 1, 2021, 6:48 p.m.
Last Update	Nov. 21, 2024, 12:44 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:intel:converged_security_management_engine_firmware::::::::	11.20	11.21.51
cpe:2.3:o:intel:converged_security_management_engine_firmware::::::::	11.10	11.11.50
cpe:2.3:o:intel:converged_security_management_engine_firmware::::::::	11.0	11.8.50

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:intel:server_platform_services_firmware::::::::					4.0

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:intel:trusted_execution_engine_firmware::::::::		3.0	3.1.50

Related information, measures and tools

No	URL	refsource	タグ
1	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html?wapkw=2018-12147	MISC	Vendor Advisory
2	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html
3	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Intel 製品に複数の脆弱性

Title	Intel 製品に複数の脆弱性
Summary	Intel から各製品向けのアップデートが公開されました。
Possible impacts	想定される影響は各脆弱性により異なりますが、次のような影響を受ける可能性があります。　情報漏えい　サービス運用妨害 (DoS) 　権限昇格　任意のコード実行
Solution	[アップデートする] Intel が提供する情報をもとに最新版へアップデートしてください。
Publication Date	Sept. 12, 2018, midnight
Registration Date	Sept. 13, 2018, 4:21 p.m.
Last Update	Oct. 1, 2019, 11:04 a.m.

Affected System

インテル

Active Management Technology

Intel Baseboard Management Controller

Intel Computing Improvement Program

Intel CSME ファームウェア

Intel Data Center Manager SDK

Intel Driver and Support Assistant

Intel Extreme Tuning Utility

Intel NUC Kit NUC7i7BNH

Intel Server Platform Services ファームウェア

Intel Software Asset Manager

Intel Trusted Execution Engine ファームウェア

OpenVINO Toolkit for Windows

Power Management Controller

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-12147	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12147
National Vulnerability Database (NVD)
2	CVE-2018-12147	https://nvd.nist.gov/vuln/detail/CVE-2018-12147

ベンダー情報

No	Name	URL
Intel
1	INTEL-SA-00125	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html
2	INTEL-SA-00131	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.html
3	INTEL-SA-00141	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00141.html
4	INTEL-SA-00143	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00143.html
5	INTEL-SA-00149	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00149.html
6	INTEL-SA-00162	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00162.html
7	INTEL-SA-00165	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00165.html
8	INTEL-SA-00172	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00172.html
9	INTEL-SA-00176	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00176.html

その他

No	Name	URL
JVN
1	JVNVU#99931791	https://jvn.jp/vu/JVNVU99931791

Change Log

No	Changed Details	Date of change
1	[2018年09月13日] 掲載	Sept. 13, 2018, 2:27 p.m.
2	[2019年10月01日] 参考情報：Common Vulnerabilities and Exposures (CVE) (CVE-2018-12147) を追加参考情報：National Vulnerability Database (NVD) (CVE-2018-12147) を追加	Oct. 1, 2019, 10 a.m.