CVE-2018-12037

Severity Score

4.0

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA max" mode), Samsung T3 and T5 portable drives, and Crucial MX100, MX200 and MX300 devices. Absence of a cryptographic link between the password and the Disk Encryption Key allows attackers with privileged access to SSD firmware full access to encrypted data.

Se ha descubierto un problema en dispositivos Samsung 840 EVO y 850 EVO (solo en modo "ATA high"; no es vulnerable en los modos "TCG" o "ATA max"), los discos duros externos Samsung T3 y T5 y los dispositivos Crucial MX100, MX200 y MX300. La falta de un enlace criptográfico entre la contraseña y la clave de cifrado del disco permite que los atacantes con acceso privilegiado al firmware SSD tengan acceso total a los datos cifrados.

*Credits: N/A

Attack Vector

Physical

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-06-07 CVE Reserved
2018-11-20 CVE Published
2023-11-14 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/105840	Third Party Advisory
https://security.netapp.com/advisory/ntap-20181112-0001	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180028	2019-10-03

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Samsung Search vendor "Samsung"	840 Evo Firmware Search vendor "Samsung" for product "840 Evo Firmware"	-	-	Affected	in	Samsung Search vendor "Samsung"	840 Evo Search vendor "Samsung" for product "840 Evo"	-	-	Safe
Samsung Search vendor "Samsung"	850 Evo Firmware Search vendor "Samsung" for product "850 Evo Firmware"	-	-	Affected	in	Samsung Search vendor "Samsung"	850 Evo Search vendor "Samsung" for product "850 Evo"	-	-	Safe
Samsung Search vendor "Samsung"	T3 Firmware Search vendor "Samsung" for product "T3 Firmware"	-	-	Affected	in	Samsung Search vendor "Samsung"	T3 Search vendor "Samsung" for product "T3"	-	-	Safe
Samsung Search vendor "Samsung"	T5 Firmware Search vendor "Samsung" for product "T5 Firmware"	-	-	Affected	in	Samsung Search vendor "Samsung"	T5 Search vendor "Samsung" for product "T5"	-	-	Safe
Micron Search vendor "Micron"	Crucial Mx100 Firmware Search vendor "Micron" for product "Crucial Mx100 Firmware"	-	-	Affected	in	Micron Search vendor "Micron"	Crucial Mx100 Search vendor "Micron" for product "Crucial Mx100"	-	-	Safe
Micron Search vendor "Micron"	Crucial Mx200 Firmware Search vendor "Micron" for product "Crucial Mx200 Firmware"	-	-	Affected	in	Micron Search vendor "Micron"	Crucial Mx200 Search vendor "Micron" for product "Crucial Mx200"	-	-	Safe
Micron Search vendor "Micron"	Crucial Mx300 Firmware Search vendor "Micron" for product "Crucial Mx300 Firmware"	-	-	Affected	in	Micron Search vendor "Micron"	Crucial Mx300 Search vendor "Micron" for product "Crucial Mx300"	-	-	Safe