Vulnerability Note VU#395981
There are multiple vulnerabilities in implementations of ATA Security or TCG Opal Standards in Self-Encrypting Disks (SEDs), which can allow an attacker to decrypt contents of an encrypted drive.
There is no cryptographic relation between the password provided by the end user and the key used for the encryption of user data. This can allow an attacker to access the key without knowing the password provided by the end user, allowing the attacker to decrypt information encrypted with that key.
According to National Cyber Security Centre – The Netherlands (NCSC-NL), the following products are affected by CVE-2018-12037:
- Crucial (Micron) MX100, MX200 and MX300 drives
- Samsung T3 and T5 portable drives
- Samsung 840 EVO and 850 EVO drives (In “ATA high” mode these devices are vulnerable, In “TCG” or “ATA max” mode these devices are NOT vulnerable.)
