Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2017-7936 (GCVE-0-2017-7936)
Vulnerability from cvelistv5
Published
2017-08-07 08:00
Modified
2024-08-05 16:19
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.
References
| URL | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | NXP i.MX Product Family |
Version: NXP i.MX Product Family |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:19:29.271Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02"
},
{
"name": "99966",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/99966"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "NXP i.MX Product Family",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "NXP i.MX Product Family"
}
]
}
],
"datePublic": "2017-08-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T09:57:02",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02"
},
{
"name": "99966",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/99966"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2017-7936",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NXP i.MX Product Family",
"version": {
"version_data": [
{
"version_value": "NXP i.MX Product Family"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02"
},
{
"name": "99966",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99966"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2017-7936",
"datePublished": "2017-08-07T08:00:00",
"dateReserved": "2017-04-18T00:00:00",
"dateUpdated": "2024-08-05T16:19:29.271Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2017-7936\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2017-08-07T08:29:00.353\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.\"},{\"lang\":\"es\",\"value\":\"Se ha descubierto un error de desbordamiento de b\u00fafer basado en pila en NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, y Vybrid VF6xx. Cuando el dispositivo est\u00e1 configurado con opciones con seguridad habilitadas, se podr\u00eda utilizar SDP para descargar una peque\u00f1a secci\u00f3n de c\u00f3digo en una parte desprotegida de memoria.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.4,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":4.4,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.4,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-121\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf30nn151cku26_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"82ABEF1B-6B93-48B5-B34B-1D155EC55ED8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf30nn151cku26:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70A93AF1-F85B-43AC-8D9B-98E47B6B001E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf30ns151cku26_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4B81B61-456E-4359-AD6B-2317376AB24C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf30ns151cku26:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61D98873-7A8C-449D-A044-B05887A890E2\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf50nn151cmk40_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26C9279-3069-4093-BA96-2CB70AEDD2F0\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf50nn151cmk40:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C674A05-5443-402D-B508-62EF31AD15BD\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf50nn151cmk50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5C139B-A4DC-414C-B278-ED4E5F5492C5\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf50nn151cmk50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F14598B-FD3C-4CFC-8DBE-FC1EA733731C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf50ns151cmk40_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F1A6ACE-A4B5-48DE-ACE4-DF50A928DE3D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf50ns151cmk40:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49CA505E-6B28-41C9-93B0-7406F489BDB0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf50ns151cmk50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"78300258-A011-4920-B39C-7B8C0412C921\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf50ns151cmk50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8C271C7-E84F-4BF8-AB80-9934BB0A5FCA\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf51nn151cmk50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"40BA42E1-0931-4ECC-8A90-8485D6071158\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf51nn151cmk50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A843151-9A62-4515-A82A-E798DD89EFF0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf51ns151cmk50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E296D84B-F3E5-4FBE-AA21-E8FDFB12F448\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf51ns151cmk50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2DD4EB6-9AC7-40AD-BFE2-EE9AB100F666\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf60nn151cmk40_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87DBF157-B729-4FE0-87E2-075C6154CCA7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf60nn151cmk40:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9DD55202-ABCF-4B87-963D-476507A721FB\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf60ns151cmk40_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE02CB27-F9E9-46EC-8D66-93482390B6FB\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf60ns151cmk40:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AD1ACEE-674D-4ECF-BDA5-A371B57DF38F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf60nn151cmk50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"902E393B-EDC6-4814-B712-C218BED08866\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf60nn151cmk50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7ADF82AB-BC34-4CE0-B5E6-9AB40241FFD6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf60ns151cmk50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBEE62D2-1F7D-4083-BB14-0BFA6B8F5A8B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf60ns151cmk50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E87BB6B2-BB8B-4264-90F3-EE2E7B63F73B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf61nn151cmk50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42B4DE7F-2141-4954-8A5A-1CA9FC61CA01\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf61nn151cmk50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A401CC61-AB8A-4AC4-B50B-4953660E9CD0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf61ns151cmk50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"881A99E8-BC43-4C28-A394-83171519F1C2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf61ns151cmk50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7921E65C-2824-446A-8BC3-563A68808270\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:vybrid_mvf62nn151cmk40_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"24B3ABED-465D-4897-9EC4-3E6AF1A7519A\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:vybrid_mvf62nn151cmk40:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D1A0B17-65C1-44AF-A686-04FBFB5C1AE7\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_50_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F523DEA-C0B0-4268-9F6A-E48282A32A8C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_50:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA014971-DCCC-4B8D-8653-DD3A158B8A1A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_53_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"14B5CAEA-5120-4089-8E31-0BC959EFF849\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_53:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0496E7EB-4D37-4333-A854-A8D45B8A86D8\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6ull_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3CF45AD7-B959-452C-81CB-FD9A40D11378\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6ull:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2CD0D2A-C1A5-4771-ADAB-70375BF06670\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6ultralite_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3ECF45-3884-4AEF-B26E-72DA6E43F49A\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6ultralite:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06A59F6D-0000-4E82-8F16-BC9BC946A7B0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6sololite_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"25507E5C-FCAC-46E1-A90F-B9AE7D554F76\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6sololite:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C42AF58-A53F-4307-A381-CD1A511F4569\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6solo_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA76C3C4-0030-4C52-BCDE-D4D963C2B511\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6solo:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A69747C-AE47-4219-8892-461341151E6C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6duallite_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28AF0906-B8CE-40FE-BEE0-03A814C55B0B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6duallite:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F40FEC3-EBBC-4B1D-9677-23B3A6D89B91\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6solox_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BCB98D4-51CD-45AB-8C5D-79989A083946\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6solox:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"71631A11-FB49-4335-BB1B-47EB9061F47B\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6dual_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"042E76C8-94AD-4F30-AFDC-D6E4C3F49FF0\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6dual:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"74D9AB2D-303F-4C16-A584-0812DE52C7EF\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6quad_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A062D5CA-B204-4209-A398-343E191A4AE3\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6quad:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2C69EB9-C38F-41AF-B1A6-0E7BB841BA58\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6quadplus_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CF0BC58B-DFD5-465A-AB3D-724DD05B6199\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6quadplus:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"623866FF-4E6B-48F8-B601-09AB288294D1\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:nxp:i.mx_6dualplus_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77688E97-E680-445E-B291-CEABBF0AC460\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:nxp:i.mx_6dualplus:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB41F948-3B57-4462-9FF5-890FBD038E66\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/99966\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/99966\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\",\"VDB Entry\"]}]}}"
}
}
icsa-17-152-02
Vulnerability from csaf_cisa
Published
2017-06-01 00:00
Modified
2017-07-25 00:00
Summary
NXP i.MX Product Family
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
REPOSTED INFORMATION
Countries/areas deployed
Worldwide
Company headquarters location
Eindhoven, Netherlands
Recommended Practices
ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Recommended Practices
ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.
Recommended Practices
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.
Recommended Practices
These vulnerabilities are not remotely exploitable. Moderate skill level is needed to exploit.
{
"document": {
"acknowledgments": [
{
"organization": "Quarkslab",
"summary": "identifying the vulnerabilities"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "REPOSTED INFORMATION",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Eindhoven, Netherlands",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "These vulnerabilities are not remotely exploitable. Moderate skill level is needed to exploit.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-17-152-02 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-152-02.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-17-152-02 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-152-02"
}
],
"title": "NXP i.MX Product Family",
"tracking": {
"current_release_date": "2017-07-25T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-17-152-02",
"initial_release_date": "2017-06-01T00:00:00.000000Z",
"revision_history": [
{
"date": "2017-06-01T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-17-152-02P NXP i.MX Product Family"
},
{
"date": "2017-07-25T00:00:00.000000Z",
"legacy_version": "A",
"number": "2",
"summary": "ICSA-17-152-02 NXP i.MX Product Family (Update A)"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 50 - *",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "i.MX 50"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 53 - *",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "i.MX 53"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6ULL - *",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "i.MX 6ULL"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6UltraLit - *",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "i.MX 6UltraLit"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6SoloLite - *",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "i.MX 6SoloLite"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6Solo - *",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "i.MX 6Solo"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6DualLite - *",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "i.MX 6DualLite"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6SoloX - *",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "i.MX 6SoloX"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6Dual - *",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "i.MX 6Dual"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6Quad - *",
"product_id": "CSAFPID-00010"
}
}
],
"category": "product_name",
"name": "i.MX 6Quad"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6DualPlus - *",
"product_id": "CSAFPID-00011"
}
}
],
"category": "product_name",
"name": "i.MX 6DualPlus"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6QuadPlus - *",
"product_id": "CSAFPID-00012"
}
}
],
"category": "product_name",
"name": "i.MX 6QuadPlus"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF3xx - *",
"product_id": "CSAFPID-00013"
}
}
],
"category": "product_name",
"name": "Vybrid VF3xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF5xx - *",
"product_id": "CSAFPID-00014"
}
}
],
"category": "product_name",
"name": "Vybrid VF5xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF6xx - *",
"product_id": "CSAFPID-00015"
}
}
],
"category": "product_name",
"name": "Vybrid VF6xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 28 - *",
"product_id": "CSAFPID-00016"
}
}
],
"category": "product_name",
"name": "i.MX 28"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": ".MX 7Solo - *",
"product_id": "CSAFPID-00017"
}
}
],
"category": "product_name",
"name": ".MX 7Solo"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 7Dual - *",
"product_id": "CSAFPID-00018"
}
}
],
"category": "product_name",
"name": "i.MX 7Dual"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF5xx - *",
"product_id": "CSAFPID-00019"
}
}
],
"category": "product_name",
"name": "Vybrid VF5xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF6xx - *",
"product_id": "CSAFPID-00020"
}
}
],
"category": "product_name",
"name": "Vybrid VF6xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6DualPlus - *",
"product_id": "CSAFPID-00021"
}
}
],
"category": "product_name",
"name": "i.MX 6DualPlus"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6QuadPlus - *",
"product_id": "CSAFPID-00022"
}
}
],
"category": "product_name",
"name": "i.MX 6QuadPlus"
}
],
"category": "vendor",
"name": "i.MX"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-7936",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "When the device is configured in security enabled configuration. SDP could be used to download a small section of code to an unprotected region of memory.CVE-2017-7936 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7936"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Because this is a hardware vulnerability, there are no software workarounds available.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "For i.MX 6UltraLite and i.MX 6ULL devices, users are encouraged to program an eFUSE to disable the Serial Download Protocol (SDP) port to mitigate the vulnerabilities.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "NXP reports a mitigation is to prevent physical access to the respective USB OTG or UART ports used by SDP in the final customer production board design.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "NXP has confirmed that the vulnerabilities have been mitigated in new versions of silicon revisions with an updated ROM module.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "For more information NXP has released an Errata and Engineering Bulletin that can be obtained from NXP support teams.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
}
]
},
{
"cve": "CVE-2017-7932",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "summary",
"text": "When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.CVE-2017-7932 has been assigned to this vulnerability. A CVSS v3 base score of 6.0 has been assigned; the CVSS vector string is (AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7932"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Because this is a hardware vulnerability, there are no software workarounds available.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "For i.MX 6UltraLite and i.MX 6ULL devices, users are encouraged to program an eFUSE to disable the Serial Download Protocol (SDP) port to mitigate the vulnerabilities.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "NXP reports a mitigation is to prevent physical access to the respective USB OTG or UART ports used by SDP in the final customer production board design.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "NXP has confirmed that the vulnerabilities have been mitigated in new versions of silicon revisions with an updated ROM module.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "For more information NXP has released an Errata and Engineering Bulletin that can be obtained from NXP support teams.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
}
]
}
]
}
ICSA-17-152-02
Vulnerability from csaf_cisa
Published
2017-06-01 00:00
Modified
2017-07-25 00:00
Summary
NXP i.MX Product Family
Notes
CISA Disclaimer
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
Legal Notice
All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.
Risk evaluation
REPOSTED INFORMATION
Countries/areas deployed
Worldwide
Company headquarters location
Eindhoven, Netherlands
Recommended Practices
ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
Recommended Practices
ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
Recommended Practices
ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Recommended Practices
Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.
Recommended Practices
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.
Recommended Practices
These vulnerabilities are not remotely exploitable. Moderate skill level is needed to exploit.
{
"document": {
"acknowledgments": [
{
"organization": "Quarkslab",
"summary": "identifying the vulnerabilities"
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Disclosure is not limited",
"tlp": {
"label": "WHITE",
"url": "https://us-cert.cisa.gov/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
"title": "CISA Disclaimer"
},
{
"category": "legal_disclaimer",
"text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
"title": "Legal Notice"
},
{
"category": "summary",
"text": "REPOSTED INFORMATION",
"title": "Risk evaluation"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries/areas deployed"
},
{
"category": "other",
"text": "Eindhoven, Netherlands",
"title": "Company headquarters location"
},
{
"category": "general",
"text": "ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Additional mitigation guidance and recommended practices are publicly available in the ICS -CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.",
"title": "Recommended Practices"
},
{
"category": "general",
"text": "These vulnerabilities are not remotely exploitable. Moderate skill level is needed to exploit.",
"title": "Recommended Practices"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "ICS Advisory ICSA-17-152-02 JSON",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2017/icsa-17-152-02.json"
},
{
"category": "self",
"summary": "ICS Advisory ICSA-17-152-02 Web Version",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-17-152-02"
}
],
"title": "NXP i.MX Product Family",
"tracking": {
"current_release_date": "2017-07-25T00:00:00.000000Z",
"generator": {
"engine": {
"name": "CISA CSAF Generator",
"version": "1.0.0"
}
},
"id": "ICSA-17-152-02",
"initial_release_date": "2017-06-01T00:00:00.000000Z",
"revision_history": [
{
"date": "2017-06-01T00:00:00.000000Z",
"legacy_version": "Initial",
"number": "1",
"summary": "ICSA-17-152-02P NXP i.MX Product Family"
},
{
"date": "2017-07-25T00:00:00.000000Z",
"legacy_version": "A",
"number": "2",
"summary": "ICSA-17-152-02 NXP i.MX Product Family (Update A)"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 50 - *",
"product_id": "CSAFPID-0001"
}
}
],
"category": "product_name",
"name": "i.MX 50"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 53 - *",
"product_id": "CSAFPID-0002"
}
}
],
"category": "product_name",
"name": "i.MX 53"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6ULL - *",
"product_id": "CSAFPID-0003"
}
}
],
"category": "product_name",
"name": "i.MX 6ULL"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6UltraLit - *",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "i.MX 6UltraLit"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6SoloLite - *",
"product_id": "CSAFPID-0005"
}
}
],
"category": "product_name",
"name": "i.MX 6SoloLite"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6Solo - *",
"product_id": "CSAFPID-0006"
}
}
],
"category": "product_name",
"name": "i.MX 6Solo"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6DualLite - *",
"product_id": "CSAFPID-0007"
}
}
],
"category": "product_name",
"name": "i.MX 6DualLite"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6SoloX - *",
"product_id": "CSAFPID-0008"
}
}
],
"category": "product_name",
"name": "i.MX 6SoloX"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6Dual - *",
"product_id": "CSAFPID-0009"
}
}
],
"category": "product_name",
"name": "i.MX 6Dual"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6Quad - *",
"product_id": "CSAFPID-00010"
}
}
],
"category": "product_name",
"name": "i.MX 6Quad"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6DualPlus - *",
"product_id": "CSAFPID-00011"
}
}
],
"category": "product_name",
"name": "i.MX 6DualPlus"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6QuadPlus - *",
"product_id": "CSAFPID-00012"
}
}
],
"category": "product_name",
"name": "i.MX 6QuadPlus"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF3xx - *",
"product_id": "CSAFPID-00013"
}
}
],
"category": "product_name",
"name": "Vybrid VF3xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF5xx - *",
"product_id": "CSAFPID-00014"
}
}
],
"category": "product_name",
"name": "Vybrid VF5xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF6xx - *",
"product_id": "CSAFPID-00015"
}
}
],
"category": "product_name",
"name": "Vybrid VF6xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 28 - *",
"product_id": "CSAFPID-00016"
}
}
],
"category": "product_name",
"name": "i.MX 28"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": ".MX 7Solo - *",
"product_id": "CSAFPID-00017"
}
}
],
"category": "product_name",
"name": ".MX 7Solo"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 7Dual - *",
"product_id": "CSAFPID-00018"
}
}
],
"category": "product_name",
"name": "i.MX 7Dual"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF5xx - *",
"product_id": "CSAFPID-00019"
}
}
],
"category": "product_name",
"name": "Vybrid VF5xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "Vybrid VF6xx - *",
"product_id": "CSAFPID-00020"
}
}
],
"category": "product_name",
"name": "Vybrid VF6xx"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6DualPlus - *",
"product_id": "CSAFPID-00021"
}
}
],
"category": "product_name",
"name": "i.MX 6DualPlus"
},
{
"branches": [
{
"category": "product_version",
"name": "vers:all/*",
"product": {
"name": "i.MX 6QuadPlus - *",
"product_id": "CSAFPID-00022"
}
}
],
"category": "product_name",
"name": "i.MX 6QuadPlus"
}
],
"category": "vendor",
"name": "i.MX"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-7936",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "summary",
"text": "When the device is configured in security enabled configuration. SDP could be used to download a small section of code to an unprotected region of memory.CVE-2017-7936 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7936"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Because this is a hardware vulnerability, there are no software workarounds available.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "For i.MX 6UltraLite and i.MX 6ULL devices, users are encouraged to program an eFUSE to disable the Serial Download Protocol (SDP) port to mitigate the vulnerabilities.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "NXP reports a mitigation is to prevent physical access to the respective USB OTG or UART ports used by SDP in the final customer production board design.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "NXP has confirmed that the vulnerabilities have been mitigated in new versions of silicon revisions with an updated ROM module.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "For more information NXP has released an Errata and Engineering Bulletin that can be obtained from NXP support teams.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
}
]
},
{
"cve": "CVE-2017-7932",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "summary",
"text": "When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.CVE-2017-7932 has been assigned to this vulnerability. A CVSS v3 base score of 6.0 has been assigned; the CVSS vector string is (AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H).",
"title": "Vulnerability Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
"references": [
{
"category": "external",
"summary": "web.nvd.nist.gov",
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7932"
},
{
"category": "external",
"summary": "www.first.org",
"url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H"
}
],
"remediations": [
{
"category": "mitigation",
"details": "Because this is a hardware vulnerability, there are no software workarounds available.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "For i.MX 6UltraLite and i.MX 6ULL devices, users are encouraged to program an eFUSE to disable the Serial Download Protocol (SDP) port to mitigate the vulnerabilities.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "NXP reports a mitigation is to prevent physical access to the respective USB OTG or UART ports used by SDP in the final customer production board design.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "NXP has confirmed that the vulnerabilities have been mitigated in new versions of silicon revisions with an updated ROM module.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
},
{
"category": "mitigation",
"details": "For more information NXP has released an Errata and Engineering Bulletin that can be obtained from NXP support teams.",
"product_ids": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-0001",
"CSAFPID-0002",
"CSAFPID-0003",
"CSAFPID-0004",
"CSAFPID-0005",
"CSAFPID-0006",
"CSAFPID-0007",
"CSAFPID-0008",
"CSAFPID-0009",
"CSAFPID-00010",
"CSAFPID-00011",
"CSAFPID-00012",
"CSAFPID-00013",
"CSAFPID-00014",
"CSAFPID-00015",
"CSAFPID-00016",
"CSAFPID-00017",
"CSAFPID-00018",
"CSAFPID-00019",
"CSAFPID-00020",
"CSAFPID-00021",
"CSAFPID-00022"
]
}
]
}
]
}
gsd-2017-7936
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2017-7936",
"description": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.",
"id": "GSD-2017-7936"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2017-7936"
],
"details": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.",
"id": "GSD-2017-7936",
"modified": "2023-12-13T01:21:06.571028Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2017-7936",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NXP i.MX Product Family",
"version": {
"version_data": [
{
"version_value": "NXP i.MX Product Family"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-121"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02",
"refsource": "MISC",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02"
},
{
"name": "99966",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/99966"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf30nn151cku26_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf30nn151cku26:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf30ns151cku26_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf30ns151cku26:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf50nn151cmk40_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf50nn151cmk40:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf50nn151cmk50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf50nn151cmk50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf50ns151cmk40_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf50ns151cmk40:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf50ns151cmk50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf50ns151cmk50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf51nn151cmk50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf51nn151cmk50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf51ns151cmk50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf51ns151cmk50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf60nn151cmk40_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf60nn151cmk40:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf60ns151cmk40_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf60ns151cmk40:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf60nn151cmk50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf60nn151cmk50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf60ns151cmk50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf60ns151cmk50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf61nn151cmk50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf61nn151cmk50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf61ns151cmk50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf61ns151cmk50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:vybrid_mvf62nn151cmk40_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:vybrid_mvf62nn151cmk40:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_50_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_50:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_53_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_53:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6ull_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6ull:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6ultralite_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6ultralite:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6sololite_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6sololite:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6solo_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6solo:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6duallite_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6duallite:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6solox_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6solox:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6dual_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6dual:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6quad_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6quad:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6quadplus_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6quadplus:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:nxp:i.mx_6dualplus_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:nxp:i.mx_6dualplus:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2017-7936"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02",
"refsource": "MISC",
"tags": [
"Third Party Advisory",
"US Government Resource",
"VDB Entry"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02"
},
{
"name": "99966",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99966"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 0.4,
"impactScore": 5.9
}
},
"lastModifiedDate": "2019-10-09T23:30Z",
"publishedDate": "2017-08-07T08:29Z"
}
}
}
var-201708-1393
Vulnerability from variot
A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory. plural NXP i.MX and Vybrid The product contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NXPi.MX50 and so on are different series of microprocessor products from NXPSemiconductors of the Netherlands. An attacker could exploit the vulnerability to cause a denial of service. Multiple i.MX Products is prone to multiple local security vulnerabilities. An attacker may exploit these issues to bypass certain security restrictions and perform unauthorized actions or execute arbitrary code within the context of the application. Failed exploit attempts will likely cause a denial-of-service condition. The following products are affected: NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual , i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201708-1393",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "i.mx 50",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6ultralite",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6quad",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6solo",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6dualplus",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6solox",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6quadplus",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6sololite",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6duallite",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6dual",
"scope": "eq",
"trust": 1.6,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf60ns151cmk40",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf61ns151cmk50",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf50nn151cmk40",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf51nn151cmk50",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf60nn151cmk50",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf50ns151cmk40",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf50ns151cmk50",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf30ns151cku26",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf61nn151cmk50",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 53",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 6ull",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf60nn151cmk40",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf50nn151cmk50",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf62nn151cmk40",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf51ns151cmk50",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf60ns151cmk50",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "vybrid mvf30nn151cku26",
"scope": "eq",
"trust": 1.0,
"vendor": "nxp",
"version": null
},
{
"model": "i.mx 50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 53",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6dual",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6duallite",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6dualplus",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6quad",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6quadplus",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6solo",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6sololite",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6solox",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6ull",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "i.mx 6ultralite",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf30nn151cku26",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf30ns151cku26",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf50nn151cmk40",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf50nn151cmk50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf50ns151cmk40",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf50ns151cmk50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf51nn151cmk50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf51ns151cmk50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf60nn151cmk40",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf60nn151cmk50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf60ns151cmk40",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf60ns151cmk50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf61nn151cmk50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf61ns151cmk50",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "vybrid mvf62nn151cmk40",
"scope": null,
"trust": 0.8,
"vendor": "nxp semiconductors",
"version": null
},
{
"model": "semiconductors i.mx",
"scope": "eq",
"trust": 0.6,
"vendor": "nxp",
"version": "50"
},
{
"model": "semiconductors i.mx",
"scope": "eq",
"trust": 0.6,
"vendor": "nxp",
"version": "53"
},
{
"model": "semiconductors i.mx 6ull",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6ultralite",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6sololite",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6solo",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6duallite",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6quad",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6solox",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6dual",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6dualplus",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors i.mx 6quadplus",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors vybrid vf3xx",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors vybrid vf5xx",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors vybrid vf6xx",
"scope": null,
"trust": 0.6,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors vybrid vf5xx",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors vybrid vf3xx",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors mifare ultralight",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors mifare reader components",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors mifare desfire ev1",
"scope": null,
"trust": 0.3,
"vendor": "nxp",
"version": null
},
{
"model": "semiconductors mifare classic",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 7solo",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 7dual",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6ultralite",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6ull",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6solox",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6sololite",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6solo",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6quadplus",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6quad",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6dualplus",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6duallite",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx 6dual",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "0"
},
{
"model": "semiconductors imx",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "530"
},
{
"model": "semiconductors imx",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "500"
},
{
"model": "semiconductors imx",
"scope": "eq",
"trust": 0.3,
"vendor": "nxp",
"version": "280"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf30nn151cku26",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf60ns151cmk40",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf60nn151cmk50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf60ns151cmk50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf61nn151cmk50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf61ns151cmk50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf62nn151cmk40",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 53",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6ull",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6ultralite",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf30ns151cku26",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6sololite",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6solo",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6duallite",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6solox",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6dual",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6quad",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6quadplus",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "i mx 6dualplus",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf50nn151cmk40",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf50nn151cmk50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf50ns151cmk40",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf50ns151cmk50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf51nn151cmk50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf51ns151cmk50",
"version": null
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vybrid mvf60nn151cmk40",
"version": null
}
],
"sources": [
{
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"db": "BID",
"id": "99966"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924"
},
{
"db": "NVD",
"id": "CVE-2017-7936"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:nxp:i.mx_50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_53_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6dual_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6duallite_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6dualplus_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6quad_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6quadplus_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6solo_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6sololite_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6solox_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6ull_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:i.mx_6ultralite_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf30nn151cku26_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf30ns151cku26_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf50nn151cmk40_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf50nn151cmk50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf50ns151cmk40_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf50ns151cmk50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf51nn151cmk50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf51ns151cmk50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf60nn151cmk40_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf60nn151cmk50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf60ns151cmk40_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf60ns151cmk50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf61nn151cmk50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf61ns151cmk50_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:nxp:vybrid_mvf62nn151cmk40_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Quarkslab.",
"sources": [
{
"db": "BID",
"id": "99966"
}
],
"trust": 0.3
},
"cve": "CVE-2017-7936",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.4,
"id": "CVE-2017-7936",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.9,
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.2,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 1.9,
"id": "CNVD-2017-23001",
"impactScore": 8.5,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:L/AC:H/Au:N/C:P/I:C/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.2,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 1.9,
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48",
"impactScore": 8.5,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:L/AC:H/Au:N/C:P/I:C/A:P",
"version": "2.9 [IVD]"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.4,
"id": "VHN-116139",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:L/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 0.4,
"id": "CVE-2017-7936",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2017-7936",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2017-7936",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2017-23001",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201704-924",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48",
"trust": 0.2,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-116139",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2017-7936",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"db": "VULHUB",
"id": "VHN-116139"
},
{
"db": "VULMON",
"id": "CVE-2017-7936"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924"
},
{
"db": "NVD",
"id": "CVE-2017-7936"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory. plural NXP i.MX and Vybrid The product contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NXPi.MX50 and so on are different series of microprocessor products from NXPSemiconductors of the Netherlands. An attacker could exploit the vulnerability to cause a denial of service. Multiple i.MX Products is prone to multiple local security vulnerabilities. \nAn attacker may exploit these issues to bypass certain security restrictions and perform unauthorized actions or execute arbitrary code within the context of the application. Failed exploit attempts will likely cause a denial-of-service condition. The following products are affected: NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual , i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx",
"sources": [
{
"db": "NVD",
"id": "CVE-2017-7936"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"db": "BID",
"id": "99966"
},
{
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"db": "VULHUB",
"id": "VHN-116139"
},
{
"db": "VULMON",
"id": "CVE-2017-7936"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2017-7936",
"trust": 3.7
},
{
"db": "ICS CERT",
"id": "ICSA-17-152-02",
"trust": 3.5
},
{
"db": "BID",
"id": "99966",
"trust": 2.7
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2017-23001",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268",
"trust": 0.8
},
{
"db": "IVD",
"id": "235898D3-C5E6-4883-BF99-CC01C40E3F48",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-116139",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2017-7936",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"db": "VULHUB",
"id": "VHN-116139"
},
{
"db": "VULMON",
"id": "CVE-2017-7936"
},
{
"db": "BID",
"id": "99966"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924"
},
{
"db": "NVD",
"id": "CVE-2017-7936"
}
]
},
"id": "VAR-201708-1393",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"db": "VULHUB",
"id": "VHN-116139"
}
],
"trust": 1.7333333062499998
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"db": "CNVD",
"id": "CNVD-2017-23001"
}
]
},
"last_update_date": "2024-11-23T22:17:49.549000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "i.MX \u0026 Vybrid Security Vulnerability Errata - ERR010872, ERR010873",
"trust": 0.8,
"url": "https://community.nxp.com/docs/DOC-334996"
},
{
"title": "Patches for multiple NXPi.MX product stack buffer overflow vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/100889"
},
{
"title": "Multiple NXP i.MX Product Buffer Error Vulnerability Fix",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99740"
},
{
"title": "usb-device-security",
"trust": 0.1,
"url": "https://github.com/parallelbeings/usb-device-security "
},
{
"title": "advisories",
"trust": 0.1,
"url": "https://github.com/inversepath/advisories "
},
{
"title": "advisories",
"trust": 0.1,
"url": "https://github.com/f-secure-foundry/advisories "
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"db": "VULMON",
"id": "CVE-2017-7936"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
},
{
"problemtype": "CWE-121",
"trust": 1.0
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-116139"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"db": "NVD",
"id": "CVE-2017-7936"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.5,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-17-152-02"
},
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/99966"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-7936"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2017-7936"
},
{
"trust": 0.3,
"url": "http://www.nxp.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/119.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/parallelbeings/usb-device-security"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"db": "VULHUB",
"id": "VHN-116139"
},
{
"db": "VULMON",
"id": "CVE-2017-7936"
},
{
"db": "BID",
"id": "99966"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924"
},
{
"db": "NVD",
"id": "CVE-2017-7936"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"db": "VULHUB",
"id": "VHN-116139"
},
{
"db": "VULMON",
"id": "CVE-2017-7936"
},
{
"db": "BID",
"id": "99966"
},
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924"
},
{
"db": "NVD",
"id": "CVE-2017-7936"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-26T00:00:00",
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"date": "2017-08-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"date": "2017-08-07T00:00:00",
"db": "VULHUB",
"id": "VHN-116139"
},
{
"date": "2017-08-07T00:00:00",
"db": "VULMON",
"id": "CVE-2017-7936"
},
{
"date": "2017-07-26T00:00:00",
"db": "BID",
"id": "99966"
},
{
"date": "2017-09-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"date": "2017-04-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201704-924"
},
{
"date": "2017-08-07T08:29:00.353000",
"db": "NVD",
"id": "CVE-2017-7936"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-08-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-23001"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-116139"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2017-7936"
},
{
"date": "2017-07-26T00:00:00",
"db": "BID",
"id": "99966"
},
{
"date": "2017-09-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2017-007268"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201704-924"
},
{
"date": "2024-11-21T03:33:00.087000",
"db": "NVD",
"id": "CVE-2017-7936"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "99966"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924"
}
],
"trust": 0.9
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural NXP i.MX and Vybrid Product buffer error vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2017-007268"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Buffer error",
"sources": [
{
"db": "IVD",
"id": "235898d3-c5e6-4883-bf99-cc01c40e3f48"
},
{
"db": "CNNVD",
"id": "CNNVD-201704-924"
}
],
"trust": 0.8
}
}
cnvd-2017-23001
Vulnerability from cnvd
Title
多款NXP i.MX产品栈缓冲区溢出漏洞
Description
NXP i.MX 50等都是荷兰NXP Semiconductors公司的不同系列的微型处理器产品。
多款NXP i.MX产品中存在栈缓冲区溢出漏洞。当设备配置为安全启用配置时，SDP可用于将一小段代码下载到未受保护的内存区域。攻击者可利用该漏洞造成拒绝服务。
Severity
中
VLAI Severity ?
Patch Name
多款NXP i.MX产品栈缓冲区溢出漏洞的补丁
Patch Description
NXP i.MX 50等都是荷兰NXP Semiconductors公司的不同系列的微型处理器产品。
多款NXP i.MX产品中存在栈缓冲区溢出漏洞。当设备配置为安全启用配置时，SDP可用于将一小段代码下载到未受保护的内存区域。攻击者可利用该漏洞造成拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://community.nxp.com/docs/DOC-334996
Reference
https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02
http://www.securityfocus.com/bid/99966
Impacted products
| Name | ['NXP Semiconductors i.MX 50', 'NXP Semiconductors i.MX 53', 'NXP Semiconductors i.MX 6ULL', 'NXP Semiconductors i.MX 6UltraLite', 'NXP Semiconductors i.MX 6SoloLite', 'NXP Semiconductors i.MX 6Solo', 'NXP Semiconductors i.MX 6DualLite', 'NXP Semiconductors i.MX 6Quad', 'NXP Semiconductors i.MX 6SoloX', 'NXP Semiconductors i.MX 6Dual', 'NXP Semiconductors i.MX 6DualPlus', 'NXP Semiconductors i.MX 6QuadPlus', 'NXP Semiconductors Vybrid VF3xx', 'NXP Semiconductors Vybrid VF5xx', 'NXP Semiconductors Vybrid VF6xx'] |
|---|
{
"bids": {
"bid": {
"bidNumber": "99966"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2017-7936"
}
},
"description": "NXP i.MX 50\u7b49\u90fd\u662f\u8377\u5170NXP Semiconductors\u516c\u53f8\u7684\u4e0d\u540c\u7cfb\u5217\u7684\u5fae\u578b\u5904\u7406\u5668\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eNXP i.MX\u4ea7\u54c1\u4e2d\u5b58\u5728\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u5f53\u8bbe\u5907\u914d\u7f6e\u4e3a\u5b89\u5168\u542f\u7528\u914d\u7f6e\u65f6\uff0cSDP\u53ef\u7528\u4e8e\u5c06\u4e00\u5c0f\u6bb5\u4ee3\u7801\u4e0b\u8f7d\u5230\u672a\u53d7\u4fdd\u62a4\u7684\u5185\u5b58\u533a\u57df\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
"discovererName": "Quarkslab.",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://community.nxp.com/docs/DOC-334996",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2017-23001",
"openTime": "2017-08-26",
"patchDescription": "NXP i.MX 50\u7b49\u90fd\u662f\u8377\u5170NXP Semiconductors\u516c\u53f8\u7684\u4e0d\u540c\u7cfb\u5217\u7684\u5fae\u578b\u5904\u7406\u5668\u4ea7\u54c1\u3002\r\n\r\n\u591a\u6b3eNXP i.MX\u4ea7\u54c1\u4e2d\u5b58\u5728\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u5f53\u8bbe\u5907\u914d\u7f6e\u4e3a\u5b89\u5168\u542f\u7528\u914d\u7f6e\u65f6\uff0cSDP\u53ef\u7528\u4e8e\u5c06\u4e00\u5c0f\u6bb5\u4ee3\u7801\u4e0b\u8f7d\u5230\u672a\u53d7\u4fdd\u62a4\u7684\u5185\u5b58\u533a\u57df\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "\u591a\u6b3eNXP i.MX\u4ea7\u54c1\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": [
"NXP Semiconductors i.MX 50",
"NXP Semiconductors i.MX 53",
"NXP Semiconductors i.MX 6ULL",
"NXP Semiconductors i.MX 6UltraLite",
"NXP Semiconductors i.MX 6SoloLite",
"NXP Semiconductors i.MX 6Solo",
"NXP Semiconductors i.MX 6DualLite",
"NXP Semiconductors i.MX 6Quad",
"NXP Semiconductors i.MX 6SoloX",
"NXP Semiconductors i.MX 6Dual",
"NXP Semiconductors i.MX 6DualPlus",
"NXP Semiconductors i.MX 6QuadPlus",
"NXP Semiconductors Vybrid VF3xx",
"NXP Semiconductors Vybrid VF5xx",
"NXP Semiconductors Vybrid VF6xx"
]
},
"referenceLink": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02\r\nhttp://www.securityfocus.com/bid/99966",
"serverity": "\u4e2d",
"submitTime": "2017-08-03",
"title": "\u591a\u6b3eNXP i.MX\u4ea7\u54c1\u6808\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}
fkie_cve-2017-7936
Vulnerability from fkie_nvd
Published
2017-08-07 08:29
Modified
2025-04-20 01:37
Severity ?
Summary
A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.
References
| URL | Tags | ||
|---|---|---|---|
| ics-cert@hq.dhs.gov | http://www.securityfocus.com/bid/99966 | Third Party Advisory, VDB Entry | |
| ics-cert@hq.dhs.gov | https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02 | Third Party Advisory, US Government Resource, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/99966 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02 | Third Party Advisory, US Government Resource, VDB Entry |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf30nn151cku26_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "82ABEF1B-6B93-48B5-B34B-1D155EC55ED8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf30nn151cku26:-:*:*:*:*:*:*:*",
"matchCriteriaId": "70A93AF1-F85B-43AC-8D9B-98E47B6B001E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf30ns151cku26_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A4B81B61-456E-4359-AD6B-2317376AB24C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf30ns151cku26:-:*:*:*:*:*:*:*",
"matchCriteriaId": "61D98873-7A8C-449D-A044-B05887A890E2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf50nn151cmk40_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D26C9279-3069-4093-BA96-2CB70AEDD2F0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf50nn151cmk40:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3C674A05-5443-402D-B508-62EF31AD15BD",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf50nn151cmk50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB5C139B-A4DC-414C-B278-ED4E5F5492C5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf50nn151cmk50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4F14598B-FD3C-4CFC-8DBE-FC1EA733731C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf50ns151cmk40_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7F1A6ACE-A4B5-48DE-ACE4-DF50A928DE3D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf50ns151cmk40:-:*:*:*:*:*:*:*",
"matchCriteriaId": "49CA505E-6B28-41C9-93B0-7406F489BDB0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf50ns151cmk50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78300258-A011-4920-B39C-7B8C0412C921",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf50ns151cmk50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B8C271C7-E84F-4BF8-AB80-9934BB0A5FCA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf51nn151cmk50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "40BA42E1-0931-4ECC-8A90-8485D6071158",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf51nn151cmk50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8A843151-9A62-4515-A82A-E798DD89EFF0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf51ns151cmk50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E296D84B-F3E5-4FBE-AA21-E8FDFB12F448",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf51ns151cmk50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2DD4EB6-9AC7-40AD-BFE2-EE9AB100F666",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf60nn151cmk40_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87DBF157-B729-4FE0-87E2-075C6154CCA7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf60nn151cmk40:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9DD55202-ABCF-4B87-963D-476507A721FB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf60ns151cmk40_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE02CB27-F9E9-46EC-8D66-93482390B6FB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf60ns151cmk40:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4AD1ACEE-674D-4ECF-BDA5-A371B57DF38F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf60nn151cmk50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "902E393B-EDC6-4814-B712-C218BED08866",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf60nn151cmk50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7ADF82AB-BC34-4CE0-B5E6-9AB40241FFD6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf60ns151cmk50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBEE62D2-1F7D-4083-BB14-0BFA6B8F5A8B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf60ns151cmk50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E87BB6B2-BB8B-4264-90F3-EE2E7B63F73B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf61nn151cmk50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "42B4DE7F-2141-4954-8A5A-1CA9FC61CA01",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf61nn151cmk50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A401CC61-AB8A-4AC4-B50B-4953660E9CD0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf61ns151cmk50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "881A99E8-BC43-4C28-A394-83171519F1C2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf61ns151cmk50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7921E65C-2824-446A-8BC3-563A68808270",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:vybrid_mvf62nn151cmk40_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "24B3ABED-465D-4897-9EC4-3E6AF1A7519A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:vybrid_mvf62nn151cmk40:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3D1A0B17-65C1-44AF-A686-04FBFB5C1AE7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_50_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7F523DEA-C0B0-4268-9F6A-E48282A32A8C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_50:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FA014971-DCCC-4B8D-8653-DD3A158B8A1A",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_53_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "14B5CAEA-5120-4089-8E31-0BC959EFF849",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_53:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0496E7EB-4D37-4333-A854-A8D45B8A86D8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6ull_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3CF45AD7-B959-452C-81CB-FD9A40D11378",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6ull:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E2CD0D2A-C1A5-4771-ADAB-70375BF06670",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6ultralite_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D3ECF45-3884-4AEF-B26E-72DA6E43F49A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6ultralite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "06A59F6D-0000-4E82-8F16-BC9BC946A7B0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6sololite_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "25507E5C-FCAC-46E1-A90F-B9AE7D554F76",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6sololite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0C42AF58-A53F-4307-A381-CD1A511F4569",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6solo_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA76C3C4-0030-4C52-BCDE-D4D963C2B511",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6solo:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6A69747C-AE47-4219-8892-461341151E6C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6duallite_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "28AF0906-B8CE-40FE-BEE0-03A814C55B0B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6duallite:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F40FEC3-EBBC-4B1D-9677-23B3A6D89B91",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6solox_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4BCB98D4-51CD-45AB-8C5D-79989A083946",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6solox:-:*:*:*:*:*:*:*",
"matchCriteriaId": "71631A11-FB49-4335-BB1B-47EB9061F47B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6dual_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "042E76C8-94AD-4F30-AFDC-D6E4C3F49FF0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6dual:-:*:*:*:*:*:*:*",
"matchCriteriaId": "74D9AB2D-303F-4C16-A584-0812DE52C7EF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6quad_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A062D5CA-B204-4209-A398-343E191A4AE3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6quad:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B2C69EB9-C38F-41AF-B1A6-0E7BB841BA58",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6quadplus_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF0BC58B-DFD5-465A-AB3D-724DD05B6199",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6quadplus:-:*:*:*:*:*:*:*",
"matchCriteriaId": "623866FF-4E6B-48F8-B601-09AB288294D1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:nxp:i.mx_6dualplus_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77688E97-E680-445E-B291-CEABBF0AC460",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:nxp:i.mx_6dualplus:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DB41F948-3B57-4462-9FF5-890FBD038E66",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory."
},
{
"lang": "es",
"value": "Se ha descubierto un error de desbordamiento de b\u00fafer basado en pila en NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, y Vybrid VF6xx. Cuando el dispositivo est\u00e1 configurado con opciones con seguridad habilitadas, se podr\u00eda utilizar SDP para descargar una peque\u00f1a secci\u00f3n de c\u00f3digo en una parte desprotegida de memoria."
}
],
"id": "CVE-2017-7936",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 0.4,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-08-07T08:29:00.353",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99966"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource",
"VDB Entry"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/99966"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource",
"VDB Entry"
],
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-121"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
ghsa-w554-2257-9wrq
Vulnerability from github
Published
2022-05-13 01:36
Modified
2022-05-13 01:36
Severity ?
VLAI Severity ?
Details
A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.
{
"affected": [],
"aliases": [
"CVE-2017-7936"
],
"database_specific": {
"cwe_ids": [
"CWE-119",
"CWE-121"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-07T08:29:00Z",
"severity": "MODERATE"
},
"details": "A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.",
"id": "GHSA-w554-2257-9wrq",
"modified": "2022-05-13T01:36:12Z",
"published": "2022-05-13T01:36:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7936"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99966"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…