CVE-2018-12037
Last modified
CVE-2018-12037 is a vulnerability of currently unknown severity. An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA max" mode), Samsung T3 and T5 portable drives, and Crucial MX100, MX200 and MX300 devices. Absence of a cryptographic link between the password and the Disk Encryption Key allows attackers with privileged access to SSD firmware full access to encrypted data.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
An issue was discovered on Samsung 840 EVO and 850 EVO devices (only in "ATA high" mode, not vulnerable in "TCG" or "ATA max" mode), Samsung T3 and T5 portable drives, and Crucial MX100, MX200 and MX300 devices. Absence of a cryptographic link between the password and the Disk Encryption Key allows attackers with privileged access to SSD firmware full access to encrypted data.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Samsung | 840 Evo Firmware | All versions |
| Samsung | 850 Evo Firmware | All versions |
| Samsung | T3 Firmware | All versions |
| Samsung | T5 Firmware | All versions |
| Micron | Crucial Mx100 Firmware | All versions |
| Micron | Crucial Mx200 Firmware | All versions |
| Micron | Crucial Mx300 Firmware | All versions |
References
- http://www.securityfocus.com/bid/105840Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180028Patch, Third Party Advisory, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20181112-0001/Third Party Advisory
- http://www.securityfocus.com/bid/105840Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180028Patch, Third Party Advisory, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20181112-0001/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-12037?
How severe is CVE-2018-12037?
How do I fix CVE-2018-12037?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-1203In Dell EMC Isilon OneFS, the compadmin is able to run tcpdu…
- CVE-2018-12030Chevereto Free before 1.0.13 has XSS.
- CVE-2018-12031Local file inclusion in Eaton Intelligent Power Manager v1.6…
- CVE-2018-12034In YARA 3.7.1 and prior, parsing a specially crafted compile…
- CVE-2018-12035In YARA 3.7.1 and prior, parsing a specially crafted compile…
- CVE-2018-12036OWASP Dependency-Check before 3.2.0 allows attackers to writ…
- CVE-2018-12038An issue was discovered on Samsung 840 EVO devices. Vendor-s…
- CVE-2018-12039joyplus-cms 1.6.0 allows Remote Code Execution because of an…
- CVE-2018-1204Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1, 8.…
- CVE-2018-12040Reflected Cross-site scripting (XSS) vulnerability in the we…
- CVE-2018-12041An issue was discovered on the MediaTek AWUS036NH wireless U…
- CVE-2018-12042Roxy Fileman through v1.4.5 has Directory traversal via the …
Are you affected by CVE-2018-12037?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST