Lucene search

MitreVULNRICHMENT:CVE-2023-39902

HistoryOct 17, 2023 - 12:00 a.m.

CVE-2023-39902

2023-10-1700:00:00

mitre

github.com

software vulnerability

u-boot secondary program loader

nxp i.mx 8m family

unauthenticated software execution

privilege escalation

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:u_boot_secondary_program_loader\\/spl\\/:u_boot_secondary_program_loader\\/spl\\/:*:*:*:*:*:*:*:*"
    ],
    "vendor": "u_boot_secondary_program_loader\\/spl\\/",
    "product": "u_boot_secondary_program_loader\\/spl\\/",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2023.07",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196

nxp.com

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.2

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2023-39902