CVE-2024-30212

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-30212
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-30212.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-30212
Published
2024-05-28T16:07:52.946Z
Modified
2026-07-15T01:49:03.290793255Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
Details

If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1,

the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM can be exposed.

The same method works to write to this memory area. If RAM contains pointers, those can be - depending on the application - overwritten to

return data from any other offset including Progam and Boot Flash.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30212.json",
    "cwe_ids": [
        "CWE-190"
    ],
    "cna_assigner": "Microchip"
}
References

Affected packages

Git / github.com/microchip-mplab-harmony/core

Affected ranges

Type
GIT
Repo
https://github.com/microchip-mplab-harmony/core
Events
Introduced
1715869e0b31f67f2295328bb79d0344a0e0729f
Fixed
d4608a4f1a140bd899cd4337cdbfb343a4339216
Database specific 
{
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.13.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v3.*
v3.0.0
v3.0.0-rc.2
v3.1.0
v3.1.0-rc.1
v3.1.1
v3.10.0
v3.10.0-rc.1
v3.10.0-rc.2
v3.10.0-rc.3
v3.10.1
v3.11.0
v3.11.0-rc.1
v3.11.1
v3.12.0
v3.12.0-E1
v3.13.0
v3.13.0-rc.1
v3.13.1
v3.13.2
v3.13.2-rc.1
v3.13.3
v3.2.0
v3.2.0-rc.1
v3.2.0-rc.2
v3.2.1
v3.3.0
v3.3.0-rc.1
v3.3.0-rc.2
v3.3.0-rc.3
v3.3.0-rc.4
v3.4.0
v3.4.0-rc.1
v3.4.0-rc.2
v3.5.0
v3.5.0-rc.1
v3.5.0-rc.2
v3.5.1
v3.5.2
v3.6.0
v3.6.0-alpha
v3.6.0-rc.1
v3.6.0-rc.2
v3.6.0-rc.3
v3.6.0-rc.4
v3.6.1
v3.7.0
v3.7.0-rc.1
v3.7.0-rc.2
v3.7.1
v3.7.2
v3.8.0
v3.8.0-rc.1
v3.8.0-rc.2
v3.8.0-rc.3
v3.8.0-rc.4
v3.8.0-tc.1
v3.8.1
v3.9.0
v3.9.0-rc.1
v3.9.0-rc.2
v3.9.1
v3.9.1-rc.1
v3.9.1-rc.2
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-30212.json"