|Affected Products:||cryptoauthlib versions prior to "20191122"|
|Class:||Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')(CWE-120)|
|Discovered by:||George Poulios|
CENSUS identified a buffer overflow vulnerability in the atcab_genkey_base function of the cryptoauthlib library. This library is part
of the standard SDK provided by Microchip and is used to drive the operation of cryptographic
co-processors sold by the vendor, such as the ATECC608A. An attacker with physical access to
an embedded device where a microcontroller unit executes a vulnerable version of this library,
may be able to execute arbitrary code on the microcontroller, by supplying malicious input
to the microcontroller. Affected manufacturers of embedded systems that use Microchip
cryptographic co-processors, are strongly recommended to update to at least version
"20191122" of the "cryptoauthlib" library.
During the security assessment of an embedded device bearing the Microchip ATSAMD51J20A
microcontroller unit and the Microchip ATECC608A cryptographic co-processor, CENSUS identified
that the microcontroller firmware was vulnerable to a buffer overflow attack.
Specifically, the firmware of the microcontroller unit used the cryptoauthlib library function atcab_genkey_base to generate a public/private key pair in the cryptographic co-processor. The "cryptoauthlib" library is part of the Microchip SDK
and is the standard mechanism by which one drives the operation of cryptographic
co-processors of Microchip.
CENSUS spotted an inconsistency between the documentation and the implementation
of atcab_genkey_base (see
The function will call atGenKey and atca_execute_command to perform public/private key generation on the cryptographic processor. The public key will then be transferred to the "public_key" buffer by means of a call to memcpy.
ATCA_STATUS atcab_genkey_base(uint8_t mode, uint16_t key_id, const uint8_t* other_data, uint8_t* public_key)
ATCACommand ca_cmd = _gDevice->mCommands;
ATCA_STATUS status = ATCA_GEN_FAIL;
// Build GenKey command
packet.param1 = mode;
packet.param2 = key_id;
memcpy(packet.data, other_data, GENKEY_OTHER_DATA_SIZE);
if ((status = atGenKey(ca_cmd, &packet)) != ATCA_SUCCESS)
if ((status = atca_execute_command(&packet, _gDevice)) != ATCA_SUCCESS)
if (public_key && packet.data[ATCA_COUNT_IDX] > 4)
82: memcpy(public_key, &packet.data[ATCA_RSP_DATA_IDX], packet.data[ATCA_COUNT_IDX] - 3);
Although the documentation states that the buffer for the
returned public key should be 64 bytes, in line 82 the size of the memcpy
operation is determined by the packet received. This packet is expected
to come from the cryptographic co-processor, however an attacker with physical access
to the device can inject such a packet with contents of their choosing
on the bus.
As the attacker freely controls the packet.data[ATCA_COUNT_IDX] value
it is possible to influence the number of bytes copied in the memcpy
operation. Any packet.data[ATCA_COUNT_IDX] value greater than 67 will
cause a buffer overflow to occur on the "public_key" buffer. Moreover,
any value greater than 195 will also cause uninitialized data to
be copied as well.
Depending on the context of the software using "cryptoauthlib" it may
be possible for the adversary to corrupt important variables used in security controls,
hijack the execution workflow, or disclose information found
in the stack / heap (depending on where packet.data is stored).
The issue has been verified to affect version "20190517" of cryptoauthlib.
The vulnerability has been patched in version "20191122" of the "cryptoauthlib" library. Affected manufacturers
of embedded systems that use Microchip cryptographic co-processors are strongly recommended to upgrade
to at least this version of the "cryptoauthlib" library.
|CVE Allocation:||September 9, 2019|
|Vendor Contact:||September 11, 2019|
|Vendor Confirmation:||October 1, 2019|
|Vendor Fix Released:||November 23, 2019|
|Public Advisory:||October 21, 2020|