CVE-2022-22819 Information

Description

NXP LPC55S66JBD64 LPC55S66JBD100 LPC55S66JEV98 LPC55S69JBD64 LPC55S69JBD100 and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

https://oxide.computer/blog/another-vulnerability-in-the-lpc55s69-rom https://www.nxp.com

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

7.8