PT-2024-13860 · Stmicroelectronics · X-Cube-Safea1 Software Package+1

Elttam + 1 · Published 2024-01-01 · Updated 2024-09-09 · CVE-2023-50096

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions STMicroelectronics STSAFE-A1xx versions prior to 3.3.7 X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications version 1.2.0

Description The issue allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications, and thus can affect user-written code that was derived from a published sample application.

Recommendations For STMicroelectronics STSAFE-A1xx versions prior to 3.3.7, update to version 3.3.7 or later to resolve the issue. For X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications version 1.2.0, consider disabling the StSafeA ReceiveBytes function until a patch is available. As a temporary workaround, restrict access to the I2C bus to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2023-50096

Affected Products

Stsafe-A1Xx

X-Cube-Safea1 Software Package

References · 9

• 🔥 https://github.com/elttam/publications/blob/master/writeups/CVE-2023-50096.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-50096 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50096 · Security Note
• https://t.me/cvenotify/66786 · Telegram Post
• https://twitter.com/elttam/status/1744613677121392772 · Twitter Post
• https://t.me/cvenotify/93863 · Telegram Post
• https://twitter.com/CVEnew/status/1741886804557476095 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1741906114906599853 · Twitter Post
• https://t.me/cibsecurity/74096 · Telegram Post