PT-2024-20727 · Renesas · Renesas Smartbond

Chris Bellows · Published 2024-07-10 · Updated 2024-07-11 · CVE-2024-25076

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Renesas SmartBond versions DA14691, DA14695, DA14697, and DA14699

Description An issue was discovered where the bootrom function responsible for validating the Flash Product Header directly uses a user-controllable size value (Length of Flash Config Section) to control a read from the QSPI device into a fixed sized buffer, resulting in a buffer overflow and execution of arbitrary code.

Recommendations For Renesas SmartBond versions DA14691, DA14695, DA14697, and DA14699, consider disabling the bootrom function responsible for validating the Flash Product Header until a patch is available. Restrict access to the QSPI device to minimize the risk of exploitation. Avoid using the Length of Flash Config Section value in the affected bootrom function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-25076

Affected Products

Renesas Smartbond

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-25076 · Security Note
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2024-0001.md · Note
• https://t.me/cvedetector/590 · Telegram Post
• https://t.me/cvenotify/85723 · Telegram Post
• https://twitter.com/CVEnew/status/1811322731641856148 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1811170388958663026 · Twitter Post