Intel Manageability Engine up to 11.20 Active Management Technology memory corruption

Summaryinfo

A vulnerability described as critical has been identified in Intel Manageability Engine up to 11.20. This impacts an unknown function of the component Active Management Technology. Such manipulation leads to memory corruption. This vulnerability is documented as CVE-2018-3632. The attack needs to be performed locally. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Intel Manageability Engine up to 11.20. Affected by this issue is an unknown code block of the component Active Management Technology. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Memory corruption in Intel Active Management Technology in Intel Converged Security Manageability Engine Firmware 6.x / 7.x / 8.x / 9.x / 10.x / 11.0 / 11.5 / 11.6 / 11.7 / 11.10 / 11.20 could be triggered by an attacker with local administrator permission on the system.

The bug was discovered 07/10/2018. The weakness was released 07/10/2018 (Website). The advisory is shared for download at intel.com. This vulnerability is handled as CVE-2018-3632 since 12/28/2017. The attack needs to be approached locally. The requirement for exploitation is a simple authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/06/2023).

The commercial vulnerability scanner Qualys is able to test this issue with plugin 38729 (Intel Active Management Technology Multiple Remote Code Execution Vulnerabilities).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-121194 and VDB-121195. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Intel

Name

• Manageability Engine

Version

• 6.x
• 7.x
• 8.x
• 9.x
• 10.x
• 11.0
• 11.5
• 11.6
• 11.7
• 11.10
• 11.20

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion