CVE-2018-12182

Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access...

CVE-2018-12182

CVE-2018-12182 affects the EDK II firmware/EDK II SMM subsystem across multiple vendor advisories. The root cause is an insufficient memory write check in the SMM service, which an authenticated local attacker could exploit to escalate privileges, disclose information, or cause denial of service....

CVE-2018-12182

Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access...

CVE-2018-12182

Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access...

CVE-2018-12182: Unintended Proxy or Intermediary

Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access...

PT-2019-8876 · Intel +2 · Edk Ii +2

Name of the Vulnerable Software and Affected Versions: EDK II affected versions not specified Description: The issue is related to an insufficient memory write check in the SMM service, which may allow an authenticated user to potentially enable escalation of privilege, information disclosure,...

AMI BIOS System Management Mode Vulnerability - Lenovo Support US

No description provided...

CVE-2018-16089

In System Management Module SMM versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user...

CVE-2018-9083

In System Management Module SMM versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability...

CVE-2018-16094

In System Management Module SMM versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow...

Command injection

In System Management Module SMM versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user...

CVE-2018-16096

In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...

CVE-2018-16096

In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...

Command injection

In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection...

CVE-2018-16092

In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...

Code injection

In System Management Module SMM versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and the system shadow file...

CVE-2018-9083 System Management Module Vulnerabilities

In System Management Module SMM versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability...

CVE-2018-16091

CVE-2018-16091 affects Lenovo System Management Module firmware older than 1.06, where the SMM certificate creation/parsing logic is vulnerable to several buffer overflows. The Lenovo advisory LEN-24374 lists this CVE among others and recommends upgrading SMM firmware to a newer level, and applyi...

CVE-2018-16096

The CVE-2018-16096 issue affects Lenovo System Management Module (SMM) firmware prerelease 1.06, where the SMM web interface for changing Enclosure VPD fails to sanitize all HTML inputs, creating a cross-site scripting risk. The vulnerability is documented alongside other SMM flaws in Lenovo LEN-...

CVE-2018-16092

CVE-2018-16092 affects Lenovo System Management Module (SMM) firmware prior to 1.06. The FFDC feature collects SMM system files, including sensitive data such as SMM user credentials and the system shadow file. This exposure could lead to confidentiality impact if FFDC data is accessed or misused...