High – 7
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

PT-2024-39: Readout protection level bypass before the first power-on cycle in GigaDevice Semiconductor products

Error type:

  • CWE-1191:On-Chip Debug and Test Interface With Improper Access Control

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Severity (CVSSv3.1): 7.6 (high)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • Severity (CVSSv4.0): 7.0 (high)

Description:

The vulnerability of readout protection level bypass before the first power-on cycle was identified in series GD32F1x0, GD32F4xx, GD32F3x0 of GigaDevice Semiconductor products.

The discovered vulnerability can be exploited by an attacker to take a snapshot of RAM before initialization or to change its state.

Vulnerability status: Confirmed by research

Date of vulnerability detection: 12.04.2023

Recommendations:  Limit physical access to critical devices with the microcontroller series GD32F1x0, GD32F4xx, GD32F3x0.

Additional information:  Press-release, Research

Researcher: Alexey Kovrizhnykh (Positive Technologies)

Identifiers:

BDU:2024-09911

Vendor:

GigaDevice Semiconductor

Vulnerable product:

GigaDevice GD32

Vulnerable versions:

series GD32F1x0, GD32F4xx, GD32F3x0