PT-2024-20728 · Renesas · Renesas Smartbond

Chris Bellows · Published 2024-07-10 · Updated 2024-08-08 · CVE-2024-25077

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Renesas SmartBond versions DA14691, DA14695, DA14697, and DA14699

Description An issue was discovered where the Nonce used for on-the-fly decryption of flash images is stored in an unsigned header, allowing its value to be modified without invalidating the signature used for secureboot image verification. Because the encryption engine for on-the-fly decryption uses AES in CTR mode without authentication, an attacker-modified Nonce can result in execution of arbitrary code.

Recommendations For Renesas SmartBond versions DA14691, DA14695, DA14697, and DA14699, consider disabling the use of AES in CTR mode without authentication as a temporary workaround until a patch is available. Restrict access to the unsigned header to minimize the risk of exploitation. Avoid modifying the Nonce value in the unsigned header until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-25077

Affected Products

Renesas Smartbond

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-25077 · Security Note
• https://github.com/atredispartners/advisories/blob/master/ATREDIS-2024-0001.md · Note
• https://t.me/cvenotify/89934 · Telegram Post
• https://t.me/cvedetector/589 · Telegram Post
• https://t.me/cvenotify/85724 · Telegram Post
• https://twitter.com/CVEnew/status/1811322732631769179 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1811170894573641734 · Twitter Post