Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities found for MPLAB® Harmony 3 Core Module by Microchip
CVE-2024-30212 (GCVE-0-2024-30212)
Vulnerability from cvelistv5 – Published: 2024-05-28 16:07 – Updated: 2025-02-13 17:47
VLAI
Title
Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
Summary
If a SCSI READ(10) command is initiated via USB using the largest LBA
(0xFFFFFFFF) with it's default block size of 512 and a count of 1,
the first 512 byte of the 0x80000000 memory area is returned to the
user. If the block count is increased, the full RAM can be exposed.
The same method works to write to this memory area. If RAM contains
pointers, those can be - depending on the application - overwritten to
return data from any other offset including Progam and Boot Flash.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Microchip-MPLAB-Harmony/core/c… | patchmitigation |
| https://github.com/Microchip-MPLAB-Harmony/core/b… | release-notes |
| https://github.com/Fehr-GmbH/blackleak |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microchip | MPLAB® Harmony 3 Core Module |
Affected:
3.0.0 , < 3.13.4
(semver)
|
|
| microchip | mplab_harmony |
Affected:
3.0.0 , < 3.13.4
(semver)
cpe:2.3:a:microchip:mplab_harmony:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:25:03.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"patch",
"mitigation",
"x_transferred"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Fehr-GmbH/blackleak"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:microchip:mplab_harmony:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mplab_harmony",
"vendor": "microchip",
"versions": [
{
"lessThan": "3.13.4",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-30212",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T14:20:02.167062Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T17:46:22.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"memory"
],
"packageName": "core",
"product": "MPLAB\u00ae Harmony 3 Core Module",
"programFiles": [
"drv_memory.c.ftl"
],
"programRoutines": [
{
"name": "DRV_MEMORY_SetupXfer"
}
],
"repo": "https://github.com/Microchip-MPLAB-Harmony",
"vendor": "Microchip",
"versions": [
{
"lessThan": "3.13.4",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned. The same applies for SCSI WRITE."
}
],
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned. The same applies for SCSI WRITE."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Fehr GmbH"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA \n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\u003cbr\u003e\nthe first 512 byte of the 0x80000000 memory area is returned to the \nuser. If the block count is increased, the full RAM can be exposed.\u003cbr\u003e\nThe same method works to write to this memory area. If RAM contains \npointers, those can be - depending on the application - overwritten to\u003cbr\u003e\nreturn data from any other offset including Progam and Boot Flash.\n\n\u003cbr\u003e"
}
],
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA \n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\n\nthe first 512 byte of the 0x80000000 memory area is returned to the \nuser. If the block count is increased, the full RAM can be exposed.\n\nThe same method works to write to this memory area. If RAM contains \npointers, those can be - depending on the application - overwritten to\n\nreturn data from any other offset including Progam and Boot Flash."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92: Forced Integer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T11:32:35.566Z",
"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
"shortName": "Microchip"
},
"references": [
{
"tags": [
"patch",
"mitigation"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md"
},
{
"url": "https://github.com/Fehr-GmbH/blackleak"
}
],
"source": {
"advisory": "PSIRT-34",
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2023-08-21T07:00:00.000Z",
"value": "Detected"
}
],
"title": "Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
"assignerShortName": "Microchip",
"cveId": "CVE-2024-30212",
"datePublished": "2024-05-28T16:07:52.946Z",
"dateReserved": "2024-03-26T03:56:03.743Z",
"dateUpdated": "2025-02-13T17:47:45.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-30212 (GCVE-0-2024-30212)
Vulnerability from nvd – Published: 2024-05-28 16:07 – Updated: 2025-02-13 17:47
VLAI
Title
Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
Summary
If a SCSI READ(10) command is initiated via USB using the largest LBA
(0xFFFFFFFF) with it's default block size of 512 and a count of 1,
the first 512 byte of the 0x80000000 memory area is returned to the
user. If the block count is increased, the full RAM can be exposed.
The same method works to write to this memory area. If RAM contains
pointers, those can be - depending on the application - overwritten to
return data from any other offset including Progam and Boot Flash.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Microchip-MPLAB-Harmony/core/c… | patchmitigation |
| https://github.com/Microchip-MPLAB-Harmony/core/b… | release-notes |
| https://github.com/Fehr-GmbH/blackleak |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microchip | MPLAB® Harmony 3 Core Module |
Affected:
3.0.0 , < 3.13.4
(semver)
|
|
| microchip | mplab_harmony |
Affected:
3.0.0 , < 3.13.4
(semver)
cpe:2.3:a:microchip:mplab_harmony:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:25:03.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"patch",
"mitigation",
"x_transferred"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216"
},
{
"tags": [
"release-notes",
"x_transferred"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Fehr-GmbH/blackleak"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:microchip:mplab_harmony:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mplab_harmony",
"vendor": "microchip",
"versions": [
{
"lessThan": "3.13.4",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-30212",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-07T14:20:02.167062Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-06T17:46:22.690Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"memory"
],
"packageName": "core",
"product": "MPLAB\u00ae Harmony 3 Core Module",
"programFiles": [
"drv_memory.c.ftl"
],
"programRoutines": [
{
"name": "DRV_MEMORY_SetupXfer"
}
],
"repo": "https://github.com/Microchip-MPLAB-Harmony",
"vendor": "Microchip",
"versions": [
{
"lessThan": "3.13.4",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned. The same applies for SCSI WRITE."
}
],
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned. The same applies for SCSI WRITE."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Fehr GmbH"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA \n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\u003cbr\u003e\nthe first 512 byte of the 0x80000000 memory area is returned to the \nuser. If the block count is increased, the full RAM can be exposed.\u003cbr\u003e\nThe same method works to write to this memory area. If RAM contains \npointers, those can be - depending on the application - overwritten to\u003cbr\u003e\nreturn data from any other offset including Progam and Boot Flash.\n\n\u003cbr\u003e"
}
],
"value": "If a SCSI READ(10) command is initiated via USB using the largest LBA \n(0xFFFFFFFF) with it\u0027s default block size of 512 and a count of 1,\n\nthe first 512 byte of the 0x80000000 memory area is returned to the \nuser. If the block count is increased, the full RAM can be exposed.\n\nThe same method works to write to this memory area. If RAM contains \npointers, those can be - depending on the application - overwritten to\n\nreturn data from any other offset including Progam and Boot Flash."
}
],
"impacts": [
{
"capecId": "CAPEC-92",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-92: Forced Integer Overflow"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "PHYSICAL",
"baseScore": 7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T11:32:35.566Z",
"orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
"shortName": "Microchip"
},
"references": [
{
"tags": [
"patch",
"mitigation"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/commit/d4608a4f1a140bd899cd4337cdbfb343a4339216"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/Microchip-MPLAB-Harmony/core/blob/master/release_notes.md"
},
{
"url": "https://github.com/Fehr-GmbH/blackleak"
}
],
"source": {
"advisory": "PSIRT-34",
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2023-08-21T07:00:00.000Z",
"value": "Detected"
}
],
"title": "Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
"assignerShortName": "Microchip",
"cveId": "CVE-2024-30212",
"datePublished": "2024-05-28T16:07:52.946Z",
"dateReserved": "2024-03-26T03:56:03.743Z",
"dateUpdated": "2025-02-13T17:47:45.803Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}