Microchip cryptoauthlib atcab_genkey_base buffer overflow
| CENSUS ID: | CENSUS-2020-0004 |
| CVE ID: | CVE-2019-16129 |
| Affected Products: | cryptoauthlib versions prior to "20191122" |
| Class: | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')(CWE-120) |
| Discovered by: | George Poulios |
CENSUS identified a buffer overflow vulnerability in the atcab_genkey_base function of the cryptoauthlib library. This library is part of the standard SDK provided by Microchip and is used to drive the operation of cryptographic co-processors sold by the vendor, such as the ATECC608A. An attacker with physical access to an embedded device where a microcontroller unit executes a vulnerable version of this library, may be able to execute arbitrary code on the microcontroller, by supplying malicious input to the microcontroller. Affected manufacturers of embedded systems that use Microchip cryptographic co-processors, are strongly recommended to update to at least version "20191122" of the "cryptoauthlib" library.
Vulnerability Details
During the security assessment of an embedded device bearing the Microchip ATSAMD51J20A microcontroller unit and the Microchip ATECC608A cryptographic co-processor, CENSUS identified that the microcontroller firmware was vulnerable to a buffer overflow attack.
Specifically, the firmware of the microcontroller unit used the cryptoauthlib library function atcab_genkey_base to generate a public/private key pair in the cryptographic co-processor. The "cryptoauthlib" library is part of the Microchip SDK and is the standard mechanism by which one drives the operation of cryptographic co-processors of Microchip.
CENSUS spotted an inconsistency between the documentation and the implementation of atcab_genkey_base (see cryptoauthlib/lib/basic/atca_basic_genkey.c).
The function will call atGenKey and atca_execute_command to perform public/private key generation on the cryptographic processor. The public key will then be transferred to the "public_key" buffer by means of a call to memcpy.
ATCA_STATUS atcab_genkey_base(uint8_t mode, uint16_t key_id, const uint8_t* other_data, uint8_t* public_key)
{
ATCAPacket packet;
ATCACommand ca_cmd = _gDevice->mCommands;
ATCA_STATUS status = ATCA_GEN_FAIL;
do
{
// Build GenKey command
packet.param1 = mode;
packet.param2 = key_id;
if (other_data)
{
memcpy(packet.data, other_data, GENKEY_OTHER_DATA_SIZE);
}
if ((status = atGenKey(ca_cmd, &packet)) != ATCA_SUCCESS)
{
break;
}
if ((status = atca_execute_command(&packet, _gDevice)) != ATCA_SUCCESS)
{
break;
}
if (public_key && packet.data[ATCA_COUNT_IDX] > 4)
{
82: memcpy(public_key, &packet.data[ATCA_RSP_DATA_IDX], packet.data[ATCA_COUNT_IDX] - 3);
}
}
while (0);
return status;
}
Although the documentation states that the buffer for the returned public key should be 64 bytes, in line 82 the size of the memcpy operation is determined by the packet received. This packet is expected to come from the cryptographic co-processor, however an attacker with physical access to the device can inject such a packet with contents of their choosing on the bus.
As the attacker freely controls the packet.data[ATCA_COUNT_IDX] value it is possible to influence the number of bytes copied in the memcpy operation. Any packet.data[ATCA_COUNT_IDX] value greater than 67 will cause a buffer overflow to occur on the "public_key" buffer. Moreover, any value greater than 195 will also cause uninitialized data to be copied as well.
Depending on the context of the software using "cryptoauthlib" it may be possible for the adversary to corrupt important variables used in security controls, hijack the execution workflow, or disclose information found in the stack / heap (depending on where packet.data is stored).
The issue has been verified to affect version "20190517" of cryptoauthlib.
Recommendation
The vulnerability has been patched in version "20191122" of the "cryptoauthlib" library. Affected manufacturers of embedded systems that use Microchip cryptographic co-processors are strongly recommended to upgrade to at least this version of the "cryptoauthlib" library.
Disclosure Timeline
| CVE Allocation: | September 9, 2019 |
| Vendor Contact: | September 11, 2019 |
| Vendor Confirmation: | October 1, 2019 |
| Vendor Fix Released: | November 23, 2019 |
| Public Advisory: | October 21, 2020 |