CVE-2018-12191

Vulnerability

A bounds check vulnerability exists in the Kernel subsystem of Intel Converged Security and Management Engine (CSME) before versions 11.8.60, 11.11.60, 11.22.60, or 12.0.20; Intel Server Platform Services (SPS) before versions 4.00.04.383 or SPS 4.01.02.174; and Intel Trusted Execution Engine (TXE) before versions 3.1.60 or 4.0.10 [1]. The flaw is triggered when an unauthenticated user with physical access interacts with the affected component.

Exploitation

An attacker requires physical access to the target system and no authentication is needed. By exploiting the improper bounds check, the attacker can execute arbitrary code within the context of the affected firmware component. No user interaction is required beyond the physical presence.

Impact

Successful exploitation grants the attacker arbitrary code execution at the privilege level of the Intel CSME, SPS, or TXE. This can lead to full compromise of platform security features, including potential disclosure of sensitive data, denial of service, or further escalation of privileges.

Mitigation

Intel has released firmware updates to address this vulnerability: CSME versions 11.8.60, 11.11.60, 11.22.60, and 12.0.20; SPS versions 4.00.04.383 and SPS 4.01.02.174; and TXE versions 3.1.60 and 4.0.10 [1]. Users should apply these updates from their system or motherboard vendor. No workarounds are documented. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.