CVE-2024-1633

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1633
During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the image, which base on 32-bit unsigned integer value, it can result to an integer overflow. An attacker can bypass memory range restriction and write data out of buffer bounds, which could result in bypass of secure boot. Affected git version from c2f286820471ed276c57e603762bd831873e5a17 until (not 

2.0 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.5 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://asrg.io/security-advisories/CVE-2024-1633/ Third Party Advisory
https://asrg.io/security-advisories/CVE-2024-1633/ Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:renesas:arm-trusted-firmware:rcar_gen3_2.5:*:*:*:*:*:*:*
OR cpe:2.3:h:renesas:r-car_d3e:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_e3e:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_h3e:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_h3ne:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_m3e:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_m3ne:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_v3h:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_v3h2:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_v3m:-:*:*:*:*:*:*:*
History

24 Jan 2025, 15:21

Type Values Removed Values Added
First Time Renesas r-car V3h
Renesas r-car V3h2
Renesas r-car E3e
Renesas r-car H3ne
Renesas r-car M3ne
Renesas r-car H3e
Renesas
Renesas arm-trusted-firmware
Renesas r-car M3e
Renesas r-car D3e
Renesas r-car V3m
References () https://asrg.io/security-advisories/CVE-2024-1633/ - () https://asrg.io/security-advisories/CVE-2024-1633/ - Third Party Advisory
CPE cpe:2.3:h:renesas:r-car_v3h:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_e3e:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_h3e:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_v3m:-:*:*:*:*:*:*:*
cpe:2.3:o:renesas:arm-trusted-firmware:rcar_gen3_2.5:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_m3e:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_d3e:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_v3h2:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_m3ne:-:*:*:*:*:*:*:*
cpe:2.3:h:renesas:r-car_h3ne:-:*:*:*:*:*:*:*

21 Nov 2024, 08:50

Type Values Removed Values Added
References () https://asrg.io/security-advisories/CVE-2024-1633/ - () https://asrg.io/security-advisories/CVE-2024-1633/ -

20 Feb 2024, 19:50

Type Values Removed Values Added
Summary
  • (es) Durante el arranque seguro, bl2 (la segunda etapa del gestor de arranque) recorre las imágenes definidas en la tabla "bl2_mem_params_descs". Para cada imagen, el bl2 lee la longitud y el destino de la imagen en el certificado de la imagen. Debido a la forma de leer la imagen, que se basa en un valor entero sin signo de 32 bits, puede provocar un desbordamiento de enteros. Un atacante puede eludir la restricción del rango de memoria y escribir datos fuera de los límites del búfer, lo que podría provocar la omisión del inicio seguro. Versión de git afectada desde c2f286820471ed276c57e603762bd831873e5a17 hasta (no

19 Feb 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-19 17:15

Updated : 2025-01-24 15:21

NVD link : CVE-2024-1633

Mitre link : CVE-2024-1633

CVE.ORG link : CVE-2024-1633

JSON object : View

Products Affected

renesas

  • r-car_e3e
  • r-car_m3ne
  • r-car_m3e
  • arm-trusted-firmware
  • r-car_v3h2
  • r-car_h3e
  • r-car_d3e
  • r-car_h3ne
  • r-car_v3h
  • r-car_v3m
CWE
CWE-190

Integer Overflow or Wraparound