CVE-2024-25077 Code injection in n/a
Attackers can modify the flash decryption nonce to bypass secure boot and execute arbitrary code on Renesas SmartBond devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25077?
CVE-2024-25077 is a critical code injection vulnerability in n/a, published on 10 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of flash images is stored in an unsigned header, allowing its value to be modified without invalidating the signature used for secureboot image verification. Because the encryption engine for on-the-fly decryption uses AES in CTR mode without authentication, an attacker-modified Nonce can result in execution of arbitrary code.
Weakness: CWE-94
Which versions are affected by CVE-2024-25077?
How do I fix CVE-2024-25077?
No fix has been published for CVE-2024-25077 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-25077 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-25077 exists.
Sources
Also known as GHSA-hg8f-ghpp-qpmq.