Vulnerability Description
During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each image, the bl2 reads the image length and destination from the image’s certificate. Because of the way of reading from the image, which base on 32-bit unsigned integer value, it can result to an integer overflow. An attacker can bypass memory range restriction and write data out of buffer bounds, which could result in bypass of secure boot. Affected git version from c2f286820471ed276c57e603762bd831873e5a17 until (not
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Renesas | Arm-Trusted-Firmware | rcar_gen3_2.5 |
| Renesas | R-Car D3E | - |
| Renesas | R-Car E3E | - |
| Renesas | R-Car H3E | - |
| Renesas | R-Car H3Ne | - |
| Renesas | R-Car M3E | - |
| Renesas | R-Car M3Ne | - |
| Renesas | R-Car V3H | - |
| Renesas | R-Car V3H2 | - |
| Renesas | R-Car V3M | - |
Related Weaknesses (CWE)
References
- https://asrg.io/security-advisories/CVE-2024-1633/Third Party Advisory
- https://asrg.io/security-advisories/CVE-2024-1633/Third Party Advisory
FAQ
What is CVE-2024-1633?
CVE-2024-1633 is a vulnerability with a CVSS score of 2.0 (LOW). During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each image, the bl2 reads the image length and destination from the ...
How severe is CVE-2024-1633?
CVE-2024-1633 has been rated LOW with a CVSS base score of 2.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-1633?
Check the references section above for vendor advisories and patch information. Affected products include: Renesas Arm-Trusted-Firmware, Renesas R-Car D3E, Renesas R-Car E3E, Renesas R-Car H3E, Renesas R-Car H3Ne.