CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2024-28183 – Anti Rollback bypass with physical access and TOCTOU attack
https://notcve.org/view.php?id=CVE-2024-28183
ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass anti-rollback protection. Anti-rollback prevents rollback to application with security version lower than one programmed in eFuse of chip. This attack can allow to boot past (passive) application partition having lower security version of the same device even in the presence of the flash encryption scheme. The attack requires carefully modifying the flash contents after the anti-rollback checks have been performed by the bootloader (before loading the application). • https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2 https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3 https://github.com/espressif/esp-idf/commit/534e3ad1fa68526a5f989fb2163856d6b7cd2c87 https://github.com/espressif/esp-idf/commit/7003f1ef0dffc73c34eb153d1b0710babb078149 https://github.com/espressif/esp-idf/commit/b2cdc0678965790f49afeb6e6b0737cd24433a05 https://github.com/espressif/esp-idf/commit/c33b9e1426121ce8cccf1a94241740be9cff68de https://github.com/espressif/esp-idf/commit/f327ddf6adab0c28d39597578572 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-24893 – Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption
https://notcve.org/view.php?id=CVE-2022-24893
ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be triggered during provisioning, because there is no check for the `SegN` field of the Transaction Start PDU. This can result in memory corruption related attacks and potentially attacker gaining control of the entire system. Patch commits are available on the 4.1, 4.2, 4.3 and 4.4 branches and users are recommended to upgrade. The upgrade is applicable for all applications and users of `ESP-BLE-MESH` component from `ESP-IDF`. • https://github.com/espressif/esp-idf/security/advisories/GHSA-7f7f-jj2q-28wm • CWE-787: Out-of-bounds Write CWE-788: Access of Memory Location After End of Buffer •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28135
https://notcve.org/view.php?id=CVE-2021-28135
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data. Una implementación de Bluetooth Classic en Espressif ESP-IDF versión 4.4 y anteriores, no maneja apropiadamente la recepción de respuestas LMP continuas no solicitadas, permitiendo a atacantes en el rango de radio desencadenar una denegación de servicio (caída) en ESP32 inundando el dispositivo de destino con datos de respuesta de características LMP • https://dl.packetstormsecurity.net/papers/general/braktooth.pdf https://github.com/espressif/esp-idf https://github.com/espressif/esp32-bt-lib https://www.espressif.com/en/products/socs/esp32 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28136
https://notcve.org/view.php?id=CVE-2021-28136
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet. Una implementación de Bluetooth Classic en Espressif ESP-IDF versiones 4.4 y anteriores, no maneja apropiadamente la recepción de múltiples paquetes de petición de capacidad LMP IO durante el proceso de emparejamiento, permitiendo a atacantes en el rango de radio desencadenar una corrupción de la memoria (y en consecuencia un bloqueo) en el ESP32 por medio de un paquete LMP reproducido (duplicado) • https://dl.packetstormsecurity.net/papers/general/braktooth.pdf https://github.com/espressif/esp-idf https://github.com/espressif/esp32-bt-lib https://www.espressif.com/en/products/socs/esp32 • CWE-787: Out-of-bounds Write •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28139
https://notcve.org/view.php?id=CVE-2021-28139
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload. La implementación de Bluetooth Classic en Espressif ESP-IDF versiones 4.4 y anteriores, no restringe apropiadamente la Página de Funcionalidades tras la recepción de un paquete LMP de Función de Respuesta Ampliada, permitiendo a atacantes en el rango de radio desencadenar una ejecución de código arbitrario en ESP32 por medio de una carga de bits de Funcionalidades Ampliadas diseñada • https://dl.packetstormsecurity.net/papers/general/braktooth.pdf https://github.com/espressif/esp-idf https://github.com/espressif/esp32-bt-lib https://www.espressif.com/en/products/socs/esp32 •