CVE-2019-16127, CVE-2019-16128 and CVE-2019-16129 for Microchip code

[Dimitrios Glynos <dimitris () census-labs com>]

Hello,

we've published a set of advisories for three vulnerabilities affecting
open source code offered by Microchip. This code is part of SDKs
used to build firmware for Microchip's microcontrollers.
All three of these issues were identified last year
by George Poulios of CENSUS.

1. CVE-2019-16127:
https://census-labs.com/news/2020/10/21/microchip-asf4-integer-overflows-in-flash_read-flash_write-and-flash_append/

This is an integer overflow that may occur while calculating
the desired range in flash memory to read / write. It may allow
an adversary to bypass any checks made by the firmware regarding
readable/writable ranges in flash memory. The vulnerable code
is part of the Hardware Abstraction Layer of the "ASF4" SDK
and so it can be found on many different devices with
different flash memory hardware.

Microchip/Atmel still distributes the vulnerable version of the
code through the start.atmel.com "web configurator" service.

2. CVE-2019-16128:
https://census-labs.com/news/2020/10/21/microchip-cryptoauthlib-atcab_sign_base-buffer-overflow/

This is a buffer overflow that may occur when a microcontroller
processes the response of a Microchip cryptographic co-processor
like ATECC608A. To drive the co-processor the "cryptoauthlib"
library is used. The library performs a memcpy() operation
to copy a crypto co-processor generated signature into a
firmware buffer. However, the number (and content) of bytes copied
is fully controllable by someone meddling with the data
arriving at the microcontroller.

Version "20191122" of cryptoauthlib addresses this issue.

3. CVE-2019-16129:
https://census-labs.com/news/2020/10/21/microchip-cryptoauthlib-atcab_genkey_base-buffer-overflow/

This is similar to CVE-2019-16128. On devices using cryptoauthlib
to control a Microchip cryptographic co-processor, it is possible
to cause a buffer overflow on the MCU by meddling with the data
returned by the co-processor to the MCU during the generation of a
public / private key-pair on the co-processor.

Version "20191122" of cryptoauthlib addresses this issue.

Kind regards,

Dimitris

Attachment: signature.asc
Description: OpenPGP digital signature