Date: Thu, 22 Oct 2020 15:14:10 +0300 From: Dimitrios Glynos <dimitris@...sus-labs.com> To: oss-security@...ts.openwall.com Subject: CVE-2019-16127, CVE-2019-16128 and CVE-2019-16129 for Microchip code Hello, we've published a set of advisories for three vulnerabilities affecting open source code offered by Microchip. This code is part of SDKs used to build firmware for Microchip's microcontrollers. All three of these issues were identified last year by George Poulios of CENSUS. 1. CVE-2019-16127: https://census-labs.com/news/2020/10/21/microchip-asf4-integer-overflows-in-flash_read-flash_write-and-flash_append/ This is an integer overflow that may occur while calculating the desired range in flash memory to read / write. It may allow an adversary to bypass any checks made by the firmware regarding readable/writable ranges in flash memory. The vulnerable code is part of the Hardware Abstraction Layer of the "ASF4" SDK and so it can be found on many different devices with different flash memory hardware. Microchip/Atmel still distributes the vulnerable version of the code through the start.atmel.com "web configurator" service. 2. CVE-2019-16128: https://census-labs.com/news/2020/10/21/microchip-cryptoauthlib-atcab_sign_base-buffer-overflow/ This is a buffer overflow that may occur when a microcontroller processes the response of a Microchip cryptographic co-processor like ATECC608A. To drive the co-processor the "cryptoauthlib" library is used. The library performs a memcpy() operation to copy a crypto co-processor generated signature into a firmware buffer. However, the number (and content) of bytes copied is fully controllable by someone meddling with the data arriving at the microcontroller. Version "20191122" of cryptoauthlib addresses this issue. 3. CVE-2019-16129: https://census-labs.com/news/2020/10/21/microchip-cryptoauthlib-atcab_genkey_base-buffer-overflow/ This is similar to CVE-2019-16128. On devices using cryptoauthlib to control a Microchip cryptographic co-processor, it is possible to cause a buffer overflow on the MCU by meddling with the data returned by the co-processor to the MCU during the generation of a public / private key-pair on the co-processor. Version "20191122" of cryptoauthlib addresses this issue. Kind regards, Dimitris Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.