Vulnerability Description
An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX RT 1020, i.MX RT 1050, i.MX RT 1060, i.MX 6 Family, i.MX 7Dual/Solo, i.MX 7ULP, i.MX 8M Quad, i.MX 8M Mini, and Vybrid. In a device security-enabled configuration, memory contents could potentially leak to physically proximate attackers via the respective SDP port in cold and warm boot attacks. (The recommended mitigation is to completely disable the SDP mode by programming a one-time programmable eFUSE. Customers can contact NXP for additional information.)
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nxp | I.Mx 6 Firmware | - |
| Nxp | I.Mx 6 | - |
| Nxp | I.Mx 6Dual Firmware | - |
| Nxp | I.Mx 6Dual | - |
| Nxp | I.Mx 6Duallite Firmware | - |
| Nxp | I.Mx 6Duallite | - |
| Nxp | I.Mx 6Dualplus Firmware | - |
| Nxp | I.Mx 6Dualplus | - |
| Nxp | I.Mx 6Quad Firmware | - |
| Nxp | I.Mx 6Quad | - |
| Nxp | I.Mx 6Quadplus Firmware | - |
| Nxp | I.Mx 6Quadplus | - |
| Nxp | I.Mx 6Solo Firmware | - |
| Nxp | I.Mx 6Solo | - |
| Nxp | I.Mx 6Sololite Firmware | - |
| Nxp | I.Mx 6Sololite | - |
| Nxp | I.Mx 6Solox Firmware | - |
| Nxp | I.Mx 6Solox | - |
| Nxp | I.Mx 6Ull Firmware | - |
| Nxp | I.Mx 6Ull | - |
Related Weaknesses (CWE)
References
- https://nxp.comProduct
- https://research.nccgroup.com/2022/11/17/cve-2022-45163/ExploitTechnical DescriptionThird Party Advisory
- https://research.nccgroup.com/category/technical-advisory/ExploitTechnical DescriptionThird Party Advisory
- https://nxp.comProduct
- https://research.nccgroup.com/2022/11/17/cve-2022-45163/ExploitTechnical DescriptionThird Party Advisory
- https://research.nccgroup.com/category/technical-advisory/ExploitTechnical DescriptionThird Party Advisory
FAQ
What is CVE-2022-45163?
CVE-2022-45163 is a vulnerability with a CVSS score of 5.3 (MEDIUM). An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX RT 1020, i.MX RT 1050, i.MX RT 1060, i.MX ...
How severe is CVE-2022-45163?
CVE-2022-45163 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-45163?
Check the references section above for vendor advisories and patch information. Affected products include: Nxp I.Mx 6 Firmware, Nxp I.Mx 6, Nxp I.Mx 6Dual Firmware, Nxp I.Mx 6Dual, Nxp I.Mx 6Duallite Firmware.