CVE-2024-30212

If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM can be exposed. The same method works to write to this memory area. If RAM contains pointers, those can be - depending on the application - overwritten to return data from any other offset including Progam and Boot Flash.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Fehr-GmbH/blackleak
https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md
https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216

Configurations

No configuration.

History

No history.

Information

Published : 2024-05-28 16:15

Updated : 2024-06-11 12:15

NVD link : CVE-2024-30212

Mitre link : CVE-2024-30212

CVE.ORG link : CVE-2024-30212

JSON object : View

Products Affected

No product.

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2024-30212", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 7.0, "automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-05-28T16:15:15.673", "references": [{"url": "https://github.com/Fehr-GmbH/blackleak", "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}, {"url": "https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md", "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}, {"url": "https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216", "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "If a SCSI READ(10) command is initiated via USB using the largest LBA \n(0xFFFFFFFF) with it's default block size of 512 and a count of 1,\n\nthe first 512 byte of the 0x80000000 memory area is returned to the \nuser. If the block count is increased, the full RAM can be exposed.\n\nThe same method works to write to this memory area. If RAM contains \npointers, those can be - depending on the application - overwritten to\n\nreturn data from any other offset including Progam and Boot Flash."}, {"lang": "es", "value": "Si se inicia un comando SCSI READ(10) a trav\u00e9s de USB utilizando el LBA m\u00e1s grande (0xFFFFFFFF) con su tama\u00f1o de bloque predeterminado de 512 y un recuento de 1, los primeros 512 bytes del \u00e1rea de memoria 0x80000000 se devuelven al usuario. Si se aumenta el n\u00famero de bloques, toda la RAM puede quedar expuesta. El mismo m\u00e9todo funciona para escribir en esta \u00e1rea de memoria. Si la RAM contiene punteros, estos se pueden sobrescribir, seg\u00fan la aplicaci\u00f3n, para devolver datos de cualquier otro desplazamiento, incluidos Progam y Boot Flash."}], "lastModified": "2024-06-11T12:15:14.847", "sourceIdentifier": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"}