PT-2021-22822 · Nxp · Nxp Kinetis K82+1

Published 2021-12-01 · Updated 2021-12-06 · CVE-2021-40154

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AC:L/AV:L/A:L/C:H/I:N/PR:L/S:U/UI:N

Name of the Vulnerable Software and Affected Versions NXP LPC55S69 devices before A3 NXP Kinetis K82 devices (affected versions not specified)

Description The issue is related to a buffer over-read that occurs when a crafted wlength value is sent in a GET Descriptor Configuration request or a GET Status-Other request during the use of USB In-System Programming (ISP) mode. This results in the disclosure of protected flash memory.

Recommendations For NXP LPC55S69 devices before A3, update to version A3 or later to resolve the issue. For NXP Kinetis K82 devices, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2021-40154

Affected Products

Nxp Kinetis K82

Nxp Lpc55S69

References · 6

• 🔥 https://github.com/Jeromeyoung/CVE-2021-40154 · Exploit
• 🔥❌ https://github.com/Xen1thLabs-AE/CVE-2021-40154 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-40154 · Security Note
• https://t.me/cibsecurity/33206 · Telegram Post
• https://t.me/cvenotify/24235 · Telegram Post
• https://darkmatter.ae/xen1thlabs/published-advisories · Note