CVE-2018-3629 : Buffer overflow in event handler in Intel Active Management Technology in Intel

Products affected by CVE-2018-3629

Intel » Active Management Technology Firmware
Versions from including (>=) 3.0 and up to, including, (<=) 11.22.70
cpe:2.3:o:intel:active_management_technology_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Intel » Core 2 Duo » Version: E4300
When used together with: Intel » Core 2 Duo » Version: E4400
When used together with: Intel » Core 2 Duo » Version: E4500
When used together with: Intel » Core 2 Duo » Version: E4600
When used together with: Intel » Core 2 Duo » Version: E4700
When used together with: Intel » Core 2 Duo » Version: E6300
When used together with: Intel » Core 2 Duo » Version: E6320
When used together with: Intel » Core 2 Duo » Version: E6400
When used together with: Intel » Core 2 Duo » Version: E6420
When used together with: Intel » Core 2 Duo » Version: E6540
When used together with: Intel » Core 2 Duo » Version: E6550
When used together with: Intel » Core 2 Duo » Version: E6600
When used together with: Intel » Core 2 Duo » Version: E6700
When used together with: Intel » Core 2 Duo » Version: E6750
When used together with: Intel » Core 2 Duo » Version: E6850
When used together with: Intel » Core 2 Duo » Version: E7200
When used together with: Intel » Core 2 Duo » Version: E7300
When used together with: Intel » Core 2 Duo » Version: E7400
When used together with: Intel » Core 2 Duo » Version: E7500
When used together with: Intel » Core 2 Duo » Version: E7600
When used together with: Intel » Core 2 Duo » Version: E8190
When used together with: Intel » Core 2 Duo » Version: E8200
When used together with: Intel » Core 2 Duo » Version: E8300
When used together with: Intel » Core 2 Duo » Version: E8400
When used together with: Intel » Core 2 Duo » Version: E8500
When used together with: Intel » Core 2 Duo » Version: E8600
When used together with: Intel » Core 2 Duo » Version: L7200
When used together with: Intel » Core 2 Duo » Version: L7300
When used together with: Intel » Core 2 Duo » Version: L7400
When used together with: Intel » Core 2 Duo » Version: L7500
When used together with: Intel » Core 2 Duo » Version: L7700
When used together with: Intel » Core 2 Duo » Version: P7350
When used together with: Intel » Core 2 Duo » Version: P7370
When used together with: Intel » Core 2 Duo » Version: P7450
When used together with: Intel » Core 2 Duo » Version: P7550
When used together with: Intel » Core 2 Duo » Version: P7570
When used together with: Intel » Core 2 Duo » Version: P8400
When used together with: Intel » Core 2 Duo » Version: P8600
When used together with: Intel » Core 2 Duo » Version: P8700
When used together with: Intel » Core 2 Duo » Version: P8800
When used together with: Intel » Core 2 Duo » Version: P9500
When used together with: Intel » Core 2 Duo » Version: P9600
When used together with: Intel » Core 2 Duo » Version: P9700
When used together with: Intel » Core 2 Duo » Version: Sl9300
When used together with: Intel » Core 2 Duo » Version: Sl9380
When used together with: Intel » Core 2 Duo » Version: Sl9400
When used together with: Intel » Core 2 Duo » Version: Sl9600
When used together with: Intel » Core 2 Duo » Version: Sp9300
When used together with: Intel » Core 2 Duo » Version: Sp9400
When used together with: Intel » Core 2 Duo » Version: Sp9600
When used together with: Intel » Core 2 Duo » Version: Su9300
When used together with: Intel » Core 2 Duo » Version: Su9400
When used together with: Intel » Core 2 Duo » Version: Su9600
When used together with: Intel » Core 2 Duo » Version: T5200
When used together with: Intel » Core 2 Duo » Version: T5250
When used together with: Intel » Core 2 Duo » Version: T5270
When used together with: Intel » Core 2 Duo » Version: T5300
When used together with: Intel » Core 2 Duo » Version: T5450
When used together with: Intel » Core 2 Duo » Version: T5470
When used together with: Intel » Core 2 Duo » Version: T5500
When used together with: Intel » Core 2 Duo » Version: T5550
When used together with: Intel » Core 2 Duo » Version: T5600
When used together with: Intel » Core 2 Duo » Version: T5670
When used together with: Intel » Core 2 Duo » Version: T5750
When used together with: Intel » Core 2 Duo » Version: T5800
When used together with: Intel » Core 2 Duo » Version: T5870
When used together with: Intel » Core 2 Duo » Version: T6400
When used together with: Intel » Core 2 Duo » Version: T6500
When used together with: Intel » Core 2 Duo » Version: T6600
When used together with: Intel » Core 2 Duo » Version: T6670
When used together with: Intel » Core 2 Duo » Version: T7100
When used together with: Intel » Core 2 Duo » Version: T7200
When used together with: Intel » Core 2 Duo » Version: T7250
When used together with: Intel » Core 2 Duo » Version: T7300
When used together with: Intel » Core 2 Duo » Version: T7400
When used together with: Intel » Core 2 Duo » Version: T7500
When used together with: Intel » Core 2 Duo » Version: T7600
When used together with: Intel » Core 2 Duo » Version: T7700
When used together with: Intel » Core 2 Duo » Version: T7800
When used together with: Intel » Core 2 Duo » Version: T8100
When used together with: Intel » Core 2 Duo » Version: T8300
When used together with: Intel » Core 2 Duo » Version: T9300
When used together with: Intel » Core 2 Duo » Version: T9400
When used together with: Intel » Core 2 Duo » Version: T9500
When used together with: Intel » Core 2 Duo » Version: T9550
When used together with: Intel » Core 2 Duo » Version: T9600
When used together with: Intel » Core 2 Duo » Version: T9800
When used together with: Intel » Core 2 Duo » Version: T9900
When used together with: Intel » Core 2 Duo » Version: U7500
When used together with: Intel » Core 2 Duo » Version: U7600
When used together with: Intel » Core 2 Duo » Version: U7700

Max 200 conditions are displayed on this page, to prevent potential performance issues, please refer to NVD for more details.

Exploit prediction scoring system (EPSS) score for CVE-2018-3629

EPSS FAQ

0.78%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-3629

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
3.3	LOW	AV:A/AC:L/Au:N/C:N/I:N/A:P	6.5	2.9	NIST
Access Vector: Adjacent Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2018-3629

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-3629

https://security.netapp.com/advisory/ntap-20190327-0001/

Intel SA-00112 Active Management Technology Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00112.html

INTEL-SA-00112
Vendor Advisory

CVEs referencing this url
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03868en_us

HPESBHF03868 rev.1 - HPE ML10 Gen9 using Intel Xeon Processor E3-1200 v5 with Intel Active Management Technology, multiple local and remote vulnerabilities
Third Party Advisory

CVEs referencing this url
http://www.securitytracker.com/id/1041362

Intel Converged SME Firmware Buffer Overflows in Intel Active Management Technology Let Remote Users Execute Arbitrary Code and Deny Service and Let Local Users Gain Elevated Privileges - SecurityTrac
Third Party Advisory;VDB Entry

CVEs referencing this url

Vulnerability Details : CVE-2018-3629

Products affected by CVE-2018-3629

Exploit prediction scoring system (EPSS) score for CVE-2018-3629

CVSS scores for CVE-2018-3629

CWE ids for CVE-2018-3629

References for CVE-2018-3629