Microchip MPLAB Harmony 3 Core Module up to 3.13.3 SCSI READ Command integer overflow

Summaryinfo

A vulnerability has been found in Microchip MPLAB Harmony 3 Core Module up to 3.13.3 and classified as problematic. The affected element is an unknown function of the component SCSI READ Command Handler. This manipulation causes integer overflow. This vulnerability is tracked as CVE-2024-30212. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic was found in Microchip MPLAB Harmony 3 Core Module up to 3.13.3. Affected by this vulnerability is an unknown part of the component SCSI READ Command Handler. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. The impact remains unknown. The summary by CVE is:

If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM can be exposed. The same method works to write to this memory area. If RAM contains pointers, those can be - depending on the application - overwritten to return data from any other offset including Progam and Boot Flash.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-30212 since 03/26/2024. Neither technical details nor an exploit are publicly available.

Upgrading to version 3.13.4 eliminates this vulnerability. Applying the patch d4608a4f1a140bd899cd4337cdbfb343a4339216 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Microchip MPLAB Harmony 3 Core Module

Version

• 3.13.0
• 3.13.1
• 3.13.2
• 3.13.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion