PT-2024-24939 · Mcuboot · Mcuboot

D3Zd3Z · Published 2024-04-26 · Updated 2024-06-05 · CVE-2024-32883

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions MCUboot (affected versions not specified)

Description The issue concerns MCUboot, a secure bootloader for 32-bit microcontrollers, which uses a TLV (tag-length-value) structure to represent image metadata. This structure is divided into protected and unprotected sections, with protected TLV entries included in the image signature to prevent tampering. However, the code fails to distinguish between TLV entries that should be protected and those that should not, allowing an attacker to add unprotected TLV entries that should be protected. The primary protected TLV entries include the dependency indication and the boot record. An attacker could inject a dependency value, causing an otherwise acceptable image to be rejected, or inject a boot record, potentially allowing an image to appear as having properties it should not have.

Recommendations As a temporary workaround, consider disabling the boot record functionality until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2024-32883

GHSA-M59C-Q9GQ-RH2J

GO-2024-2799

Affected Products

Mcuboot

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32883.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32883 · Security Note
• https://osv.dev/vulnerability/GO-2024-2799 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32883 · Vendor Advisory
• https://github.com/mcu-tools/mcuboot/security/advisories/GHSA-m59c-q9gq-rh2j · Note
• https://t.me/cvenotify/78215 · Telegram Post
• https://twitter.com/CVEnew/status/1783967819111026715 · Twitter Post
• https://t.me/cvenotify/78382 · Telegram Post