ESB-2017.1830 - [Appliance] NXP i.MX Product Family: Multiple vulnerabilities 2017-07-26

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.1830
             Advisory (ICSA-17-152-02) NXP i.MX Product Family
                               26 July 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           NXP i.MX Product Family
Publisher:         ICS-CERT
Operating System:  Network Appliance
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Access Privileged Data          -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
                   Provide Misleading Information  -- Remote/Unauthenticated
Resolution:        Mitigation
CVE Names:         CVE-2017-7936 CVE-2017-7932 

Original Bulletin: 
   https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02

- --------------------------BEGIN INCLUDED TEXT--------------------

Advisory (ICSA-17-152-02)

NXP i.MX Product Family

Original release date: July 25, 2017

Legal Notice

All information products included in http://ics-cert.us-cert.gov are provided
"as is" for informational purposes only. The Department of Homeland Security
(DHS) does not provide any warranties of any kind regarding any information
contained within. DHS does not endorse any commercial product or service,
referenced in this product or otherwise. Further dissemination of this
product is governed by the Traffic Light Protocol (TLP) marking in the
header. For more information about TLP, see http://www.us-cert.gov/tlp/.

CVSS v3 6.0

REPOSTED INFORMATION

This advisory was originally posted to the NCCIC Portal on June 1, 2017,
and is being released to the NCCIC/ICS-CERT web site.

AFFECTED PRODUCTS

The following i.MX Devices, used on logic boards, are affected:

Devices affected by the Stack Buffer Overflow vulnerability:

    i.MX 50,
    i.MX 53,
    i.MX 6ULL,
    i.MX 6UltraLite,
    i.MX 6SoloLite,
    i.MX 6Solo,
    i.MX 6DualLite,
    i.MX 6SoloX,
    i.MX 6Dual,
    i.MX 6Quad,
    i.MX 6DualPlus,
    i.MX 6QuadPlus,
    Vybrid VF3xx,
    Vybrid VF5xx, and
    Vybrid VF6xx

Devices Affected by the Improper Certificate Validation Vulnerability:

    i.MX 28
    i.MX 50,
    i.MX 53,
    i.MX 7Solo
    i.MX 7Dual
    Vybrid VF3xx,
    Vybrid VF5xx,
    Vybrid VF6xx,
    i.MX 6ULL,
    i.MX 6UltraLite,
    i.MX 6SoloLite,
    i.MX 6Solo,
    i.MX 6DualLite,
    i.MX 6SoloX,
    i.MX 6Dual,
    i.MX 6Quad,
    i.MX 6DualPlus, and
    i.MX 6QuadPlus

IMPACT

Successful exploitation of these vulnerabilities could allow an attacker
to cause a denial of service on the device due to a buffer overflow
condition. When the device is placed in security-enabled mode it is
possible for an attacker to exploit memory or a certificate to load an
unauthorized image on the device affecting secure boot. Vulnerabilities
are only exploitable when the device is placed in security enabled mode.

MITIGATION

Because this is a hardware vulnerability, there are no software workarounds
available.

For i.MX 6UltraLite and i.MX 6ULL devices, users are encouraged to program
an eFUSE to disable the Serial Download Protocol (SDP) port to mitigate
the vulnerabilities.

NXP reports a mitigation is to prevent physical access to the respective USB
OTG or UART ports used by SDP in the final customer production board design.

NXP has confirmed that the vulnerabilities have been mitigated in new
versions of silicon revisions with an updated ROM module.

For more information NXP has released an Errata and Engineering Bulletin
that can be obtained from NXP support teams. It is also available at:

https://community.nxp.com/docs/DOC-334996.

ICS-CERT recommends that users take defensive measures to minimize the
risk of exploitation of these vulnerabilities. Specifically, users should:

    Prevent physical access to logic boards if system design allows.

ICS-CERT reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.

ICS-CERT also provides a section for control systems security recommended
practices on the ICS-CERT web page. Several recommended practices are
available for reading and download, including Improving Industrial Control
Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are
publicly available in the ICS-CERT Technical Information Paper,
ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation
Strategies, that is available for download from the ICS-CERT web site.

Organizations observing any suspected malicious activity should follow their
established internal procedures and report their findings to ICS-CERT for
tracking and correlation against other incidents.

These vulnerabilities are not remotely exploitable. Moderate skill level
is needed to exploit.

VULNERABILITY OVERVIEW

STACK-BASED BUFFER OVERFLOW CWE-121

When the device is configured in security enabled configuration. SDP could be
used to download a small section of code to an unprotected region of memory.

CVE-2017-7936 has been assigned to this vulnerability. A CVSS v3
base score of 5.3 has been assigned; the CVSS vector string is
(AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).

IMPROPER CERTIFICATE VALIDATION CWE-295

When the device is configured in security enabled configuration, under
certain conditions it is possible to bypass the signature verification
by using a specially crafted certificate leading to the execution of an
unsigned image.

CVE-2017-7932 has been assigned to this vulnerability. A CVSS v3
base score of 6.0 has been assigned; the CVSS vector string is
(AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H).

RESEARCHER

Quarkslab identified the vulnerabilities.

BACKGROUND

Critical Infrastructure Sector(s): Transportation Systems, Critical
Manufacturing

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Eindhoven, Netherlands

Contact Information

For any questions related to this report, please contact ICS-CERT at:

Email: ics-cert@hq.dhs.gov
Toll Free: 1-877-776-7585
International Callers: (208) 526-0900

For industrial control systems security information and incident reporting:
http://ics-cert.us-cert.gov

ICS-CERT continuously strives to improve its products and services. You
can help by choosing one of the links below to provide feedback about
this product.

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWXf0XIx+lLeg9Ub1AQgtOQ//SIWJeiLIBgnFZPuJLsF7WPr1oBsp+Znz
rxnfwxhgS4FEfb5A5NRB76IMNLq3DMRr43bw/BfpXxv1TG2k6UoRJJJF5lmgvRXI
LOSKzhWeCWjO4+9O0X2BwkEh5o4QHxAAcf054s9eCOhS+RP+Y3SI+VgADGYvokLF
ZeCDR+lArB8tbWNo+4e3Z5/P7kLifvvO1Dkz2FHSO2r2qfMHBXudyIbAos5lJjjO
F8WVhjzSkBp6mk/J7mxJacpjRJCRII6v2wVETBGe1GSY7cNHnmIUZDshyRQyq5sE
RUggMSsLfWSfCqkdDv8rfEa4ai+GsgXXxf6VgY2xB20jsAvq1yQJl9tNy1pqH2Uq
BQFYkkuIvQXtEWncI8Frwcc+msef4t6J73PXxeJChjNuYxzDFg9hdjdWmzDHPzgZ
eCz72CernpCfNx5V/aMQjoTWGvZEwbM6LhRgk/5nhnTAbI2dkgKxxMpJVjY4fME6
4hc8bnLViSgu0T6+WGdSNc9rCRMpxJ56Rf5jRVKCwH1wzFFBMv7nUQyVx8AkAFYA
oJI+Z4UlVGiOP8qIKRmJgZ3sDsVLCIyCF0GVKNKGpubUa+cU4HdyauptCo+qraVu
LQ3jzNG3EgzlLuzBKzj3qnL7LzYT9WjPFQ3txEodgO8KYxWBoPnde+VgMqK1xa15
4HyplbOusyQ=
=IGDc
-----END PGP SIGNATURE-----

« Back to bulletins