CVE-2018-12037 - An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnera

CVE-2018-12037

Summary

An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA max" mode), Samsung T3 and T5 portable drives, and Crucial MX100, MX200 and MX300 devices. Absence of a cryptographic link between the password and the Disk Encryption Key allows attackers with privileged access to SSD firmware full access to encrypted data.

References

Vulnerable Configurations

cpe:2.3:o:samsung:840_evo_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:840_evo_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:840_evo:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:840_evo:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:850_evo_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:850_evo_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:850_evo:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:850_evo:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:t3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:t3_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:t3:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:t3:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:t5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:samsung:t5_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:t5:-:*:*:*:*:*:*:*
cpe:2.3:h:samsung:t5:-:*:*:*:*:*:*:*
cpe:2.3:o:micron:crucial_mx100_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:micron:crucial_mx100_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:micron:crucial_mx100:-:*:*:*:*:*:*:*
cpe:2.3:h:micron:crucial_mx100:-:*:*:*:*:*:*:*
cpe:2.3:o:micron:crucial_mx200_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:micron:crucial_mx200_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:micron:crucial_mx200:-:*:*:*:*:*:*:*
cpe:2.3:h:micron:crucial_mx200:-:*:*:*:*:*:*:*
cpe:2.3:o:micron:crucial_mx300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:micron:crucial_mx300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:micron:crucial_mx300:-:*:*:*:*:*:*:*
cpe:2.3:h:micron:crucial_mx300:-:*:*:*:*:*:*:*

CVSS

Base:	1.9 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:L/AC:M/Au:N/C:P/I:N/A:N

refmap via4

bid	105840
confirm	https://security.netapp.com/advisory/ntap-20181112-0001/
misc	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180028

Last major update

03-10-2019 - 00:03

Published

20-11-2018 - 19:29

Last modified

03-10-2019 - 00:03