CVE-2024-30212 (GCVE-0-2024-30212)
Vulnerability from cvelistv5 – Published: 2024-05-28 16:07 – Updated: 2025-02-13 17:47
VLAI?
Summary
If a SCSI READ(10) command is initiated via USB using the largest LBA
(0xFFFFFFFF) with it's default block size of 512 and a count of 1,
the first 512 byte of the 0x80000000 memory area is returned to the
user. If the block count is increased, the full RAM can be exposed.
The same method works to write to this memory area. If RAM contains
pointers, those can be - depending on the application - overwritten to
return data from any other offset including Progam and Boot Flash.
Severity ?
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Microchip | MPLAB® Harmony 3 Core Module |
Affected:
3.0.0 , < 3.13.4
(semver)
|
Credits
Fehr GmbH
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:25:03.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"patch",
"mitigation",
"x_transferred"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Fehr-GmbH/blackleak"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:microchip:mplab_harmony:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mplab_harmony",
"vendor": "microchip",
"versions": [
{
"lessThan": "3.13.4",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-30212",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T14:20:02.167062Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T17:46:22.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"memory"
],
"packageName": "core",
"product": "MPLAB\u00ae Harmony 3 Core Module",
"programFiles": [
"drv_memory.c.ftl"
],
"programRoutines": [
{
"name": "DRV_MEMORY_SetupXfer"
}
],
"repo": "https://github.com/Microchip-MPLAB-Harmony",
"vendor": "Microchip",
"versions": [
{
"lessThan": "3.13.4",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned. The same applies for SCSI WRITE."
}
],
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned. The same applies for SCSI WRITE."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Fehr GmbH"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA \n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\u003cbr\u003e\nthe first 512 byte of the 0x80000000 memory area is returned to the \nuser. If the block count is increased, the full RAM can be exposed.\u003cbr\u003e\nThe same method works to write to this memory area. If RAM contains \npointers, those can be - depending on the application - overwritten to\u003cbr\u003e\nreturn data from any other offset including Progam and Boot Flash.\n\n\u003cbr\u003e"
}
],
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA \n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\n\nthe first 512 byte of the 0x80000000 memory area is returned to the \nuser. If the block count is increased, the full RAM can be exposed.\n\nThe same method works to write to this memory area. If RAM contains \npointers, those can be - depending on the application - overwritten to\n\nreturn data from any other offset including Progam and Boot Flash."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92: Forced Integer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T11:32:35.566Z",
"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
"shortName": "Microchip"
},
"references": [
{
"tags": [
"patch",
"mitigation"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md"
},
{
"url": "https://github.com/Fehr-GmbH/blackleak"
}
],
"source": {
"advisory": "PSIRT-34",
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2023-08-21T07:00:00.000Z",
"value": "Detected"
}
],
"title": "Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
"assignerShortName": "Microchip",
"cveId": "CVE-2024-30212",
"datePublished": "2024-05-28T16:07:52.946Z",
"dateReserved": "2024-03-26T03:56:03.743Z",
"dateUpdated": "2025-02-13T17:47:45.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"If a SCSI READ(10) command is initiated via USB using the largest LBA \\n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\\n\\nthe first 512 byte of the 0x80000000 memory area is returned to the \\nuser. If the block count is increased, the full RAM can be exposed.\\n\\nThe same method works to write to this memory area. If RAM contains \\npointers, those can be - depending on the application - overwritten to\\n\\nreturn data from any other offset including Progam and Boot Flash.\"}, {\"lang\": \"es\", \"value\": \"Si se inicia un comando SCSI READ(10) a trav\\u00e9s de USB utilizando el LBA m\\u00e1s grande (0xFFFFFFFF) con su tama\\u00f1o de bloque predeterminado de 512 y un recuento de 1, los primeros 512 bytes del \\u00e1rea de memoria 0x80000000 se devuelven al usuario. Si se aumenta el n\\u00famero de bloques, toda la RAM puede quedar expuesta. El mismo m\\u00e9todo funciona para escribir en esta \\u00e1rea de memoria. Si la RAM contiene punteros, estos se pueden sobrescribir, seg\\u00fan la aplicaci\\u00f3n, para devolver datos de cualquier otro desplazamiento, incluidos Progam y Boot Flash.\"}]",
"id": "CVE-2024-30212",
"lastModified": "2024-11-21T09:11:27.310",
"metrics": "{\"cvssMetricV40\": [{\"source\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\", \"baseScore\": 7.0, \"baseSeverity\": \"HIGH\", \"attackVector\": \"PHYSICAL\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnerableSystemConfidentiality\": \"HIGH\", \"vulnerableSystemIntegrity\": \"HIGH\", \"vulnerableSystemAvailability\": \"HIGH\", \"subsequentSystemConfidentiality\": \"NONE\", \"subsequentSystemIntegrity\": \"NONE\", \"subsequentSystemAvailability\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"confidentialityRequirements\": \"NOT_DEFINED\", \"integrityRequirements\": \"NOT_DEFINED\", \"availabilityRequirements\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"NOT_DEFINED\", \"modifiedAttackComplexity\": \"NOT_DEFINED\", \"modifiedAttackRequirements\": \"NOT_DEFINED\", \"modifiedPrivilegesRequired\": \"NOT_DEFINED\", \"modifiedUserInteraction\": \"NOT_DEFINED\", \"modifiedVulnerableSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedVulnerableSystemIntegrity\": \"NOT_DEFINED\", \"modifiedVulnerableSystemAvailability\": \"NOT_DEFINED\", \"modifiedSubsequentSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedSubsequentSystemIntegrity\": \"NOT_DEFINED\", \"modifiedSubsequentSystemAvailability\": \"NOT_DEFINED\", \"safety\": \"NOT_DEFINED\", \"automatable\": \"NOT_DEFINED\", \"recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\"}}]}",
"published": "2024-05-28T16:15:15.673",
"references": "[{\"url\": \"https://github.com/Fehr-GmbH/blackleak\", \"source\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\"}, {\"url\": \"https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md\", \"source\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\"}, {\"url\": \"https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216\", \"source\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\"}, {\"url\": \"https://github.com/Fehr-GmbH/blackleak\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-190\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-30212\",\"sourceIdentifier\":\"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\",\"published\":\"2024-05-28T16:15:15.673\",\"lastModified\":\"2024-11-21T09:11:27.310\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"If a SCSI READ(10) command is initiated via USB using the largest LBA \\n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\\n\\nthe first 512 byte of the 0x80000000 memory area is returned to the \\nuser. If the block count is increased, the full RAM can be exposed.\\n\\nThe same method works to write to this memory area. If RAM contains \\npointers, those can be - depending on the application - overwritten to\\n\\nreturn data from any other offset including Progam and Boot Flash.\"},{\"lang\":\"es\",\"value\":\"Si se inicia un comando SCSI READ(10) a trav\u00e9s de USB utilizando el LBA m\u00e1s grande (0xFFFFFFFF) con su tama\u00f1o de bloque predeterminado de 512 y un recuento de 1, los primeros 512 bytes del \u00e1rea de memoria 0x80000000 se devuelven al usuario. Si se aumenta el n\u00famero de bloques, toda la RAM puede quedar expuesta. El mismo m\u00e9todo funciona para escribir en esta \u00e1rea de memoria. Si la RAM contiene punteros, estos se pueden sobrescribir, seg\u00fan la aplicaci\u00f3n, para devolver datos de cualquier otro desplazamiento, incluidos Progam y Boot Flash.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"references\":[{\"url\":\"https://github.com/Fehr-GmbH/blackleak\",\"source\":\"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\"},{\"url\":\"https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md\",\"source\":\"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\"},{\"url\":\"https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216\",\"source\":\"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\"},{\"url\":\"https://github.com/Fehr-GmbH/blackleak\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216\", \"tags\": [\"patch\", \"mitigation\", \"x_transferred\"]}, {\"url\": \"https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md\", \"tags\": [\"release-notes\", \"x_transferred\"]}, {\"url\": \"https://github.com/Fehr-GmbH/blackleak\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T01:25:03.425Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-30212\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-07T14:20:02.167062Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:microchip:mplab_harmony:*:*:*:*:*:*:*:*\"], \"vendor\": \"microchip\", \"product\": \"mplab_harmony\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.13.4\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-30T14:50:44.815Z\"}}], \"cna\": {\"title\": \"Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command\", \"source\": {\"advisory\": \"PSIRT-34\", \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Fehr GmbH\"}], \"impacts\": [{\"capecId\": \"CAPEC-92\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-92: Forced Integer Overflow\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/Microchip-MPLAB-Harmony\", \"vendor\": \"Microchip\", \"modules\": [\"memory\"], \"product\": \"MPLAB\\u00ae Harmony 3 Core Module\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.13.4\", \"versionType\": \"semver\"}], \"packageName\": \"core\", \"programFiles\": [\"drv_memory.c.ftl\"], \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"DRV_MEMORY_SetupXfer\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2023-08-21T07:00:00.000Z\", \"value\": \"Detected\"}], \"references\": [{\"url\": \"https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216\", \"tags\": [\"patch\", \"mitigation\"]}, {\"url\": \"https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://github.com/Fehr-GmbH/blackleak\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"If a SCSI READ(10) command is initiated via USB using the largest LBA \\n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\\n\\nthe first 512 byte of the 0x80000000 memory area is returned to the \\nuser. If the block count is increased, the full RAM can be exposed.\\n\\nThe same method works to write to this memory area. If RAM contains \\npointers, those can be - depending on the application - overwritten to\\n\\nreturn data from any other offset including Progam and Boot Flash.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"If a SCSI READ(10) command is initiated via USB using the largest LBA \\n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\u003cbr\u003e\\nthe first 512 byte of the 0x80000000 memory area is returned to the \\nuser. If the block count is increased, the full RAM can be exposed.\u003cbr\u003e\\nThe same method works to write to this memory area. If RAM contains \\npointers, those can be - depending on the application - overwritten to\u003cbr\u003e\\nreturn data from any other offset including Progam and Boot Flash.\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"CWE-190: Integer Overflow or Wraparound\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned. The same applies for SCSI WRITE.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned. The same applies for SCSI WRITE.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\", \"shortName\": \"Microchip\", \"dateUpdated\": \"2024-05-28T16:07:52.946Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-30212\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-06T17:46:22.690Z\", \"dateReserved\": \"2024-03-26T03:56:03.743Z\", \"assignerOrgId\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\", \"datePublished\": \"2024-05-28T16:07:52.946Z\", \"assignerShortName\": \"Microchip\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…