Format string

2023-10-1712:15:00

PRIOn knowledge base

www.prio-n.com

software vulnerability

u-boot spl

nxp i.mx 8m

privilege escalation

unauthenticated software

fit format

memory overwrite

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus.

CPENameOperatorVersion
uboot_secondary_program_loaderlt2023.07

CPE	Name	Operator	Version
	uboot_secondary_program_loader	lt	2023.07

References

community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196

nxp.com