CVE:CVE-2018-12147
CNNVD:CNNVD-201906-563
Intel Converged Security and Management Engine（CSME）等都是美国英特尔（Intel）公司的产品。Intel Converged Security and Management Engine是一款安全管理引擎。Intel Server Platform Services（SPS）是一款服务器平台服务程序。Intel Trusted Execution Engine是一款使用在CPU（中央处理器）中具有硬件验证功能的信任执行引擎。
使用11.21.55之前版本固件的Intel CSME、使用4.0之前版本固件的Intel Server Platform Services和使用3.1.55版本固件的Intel Trusted Execution Engine中的HECI subsystem存在输入验证错误漏洞。该漏洞源于网络系统或产品未对输入的数据进行正确的验证。
solution:Upgrade intel converged_security_management_engine_firmware to a higher version than 11.8.50,11.11.50,11.21.51,and avoid the version [11.0,11.8.50],[11.10,11.11.50],[11.20,11.21.51]; Upgrade intel server_platform_services_firmware to a higher version than 4.0,and avoid the version (,4.0); Upgrade intel trusted_execution_engine_firmware to a higher version than 3.1.50,and avoid the version [3.0,3.1.50]