// For flags

CVE-2018-6622

 

Severity Score

7.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered that affects all producers of BIOS firmware who make a certain realistic interpretation of an obscure portion of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2.0 specification. An abnormal case is not handled properly by this firmware while S3 sleep and can clear TPM 2.0. It allows local users to overwrite static PCRs of TPM and neutralize the security features of it, such as seal/unseal and remote attestation.

Se descubrió un problema que afecta a todos los fabricantes de firmware de BIOS que realizan una cierta interpretación realista de una porción ofuscada de la especificación Trusted Platform Module (TPM) de Trusted Computing Group (TCG). Un caso anormal no es manejado correctamente por este firmware mientras S3 está en reposo y puede borrar TPM 2.0. Permite a los usuarios locales sobrescribir PCRs estáticos de TPM y neutralizar las características de seguridad de los mismos, como el sellado/desellado y la certificación remota.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-02-04 CVE Reserved
  • 2018-08-17 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
CAPEC
References (2)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Trustedcomputinggroup
Search vendor "Trustedcomputinggroup"
Trusted Platform Module
Search vendor "Trustedcomputinggroup" for product "Trusted Platform Module"
2.0
Search vendor "Trustedcomputinggroup" for product "Trusted Platform Module" and version "2.0"
-
Affected