PT-2022-15694 · Nxp · Lpc55S69Jbd100+5

Laura Abbott · Published 2022-03-23 · Updated 2022-04-15 · CVE-2022-22819

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions NXP LPC55S66JBD64 version 1B NXP LPC55S66JBD100 version 1B NXP LPC55S66JEV98 version 1B NXP LPC55S69JBD64 version 1B NXP LPC55S69JBD100 version 1B NXP LPC55S69JEV98 version 1B

Description The issue is related to a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.

Recommendations For NXP LPC55S66JBD64 version 1B, consider disabling SB2 update parsing until a patch is available. For NXP LPC55S66JBD100 version 1B, consider disabling SB2 update parsing until a patch is available. For NXP LPC55S66JEV98 version 1B, consider disabling SB2 update parsing until a patch is available. For NXP LPC55S69JBD64 version 1B, consider disabling SB2 update parsing until a patch is available. For NXP LPC55S69JBD100 version 1B, consider disabling SB2 update parsing until a patch is available. For NXP LPC55S69JEV98 version 1B, consider disabling SB2 update parsing until a patch is available.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-22819

Affected Products

Lpc55S66Jbd100

Lpc55S66Jbd64

Lpc55S66Jev98

Lpc55S69Jbd100

Lpc55S69Jbd64

Lpc55S69Jev98

References · 4

• 🔥 https://oxide.computer/blog/another-vulnerability-in-the-lpc55s69-rom · Exploit
• https://nxp.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22819 · Security Note
• https://t.me/cibsecurity/39465 · Telegram Post