CVE-2022-45163

Description

An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX RT 1020, i.MX RT 1050, i.MX RT 1060, i.MX 6 Family, i.MX 7Dual/Solo, i.MX 7ULP, i.MX 8M Quad, i.MX 8M Mini, and Vybrid. In a device security-enabled configuration, memory contents could potentially leak to physically proximate attackers via the respective SDP port in cold and warm boot attacks. (The recommended mitigation is to completely disable the SDP mode by programming a one-time programmable eFUSE. Customers can contact NXP for additional information.)

CVSS 3.1

4.6 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.59% probability · 46th percentile

CISA KEV

Not listed

Weakness

CWE-203

Affected

nxp/i.mx 6 firmware · nxp/i.mx 6dual firmware · nxp/i.mx 6duallite firmware · nxp/i.mx 6dualplus firmware · nxp/i.mx 6quad firmware · nxp/i.mx 6quadplus firmware · nxp/i.mx 6solo firmware · nxp/i.mx 6sololite firmware · nxp/i.mx 6solox firmware · nxp/i.mx 6ull firmware · nxp/i.mx 6ultralite firmware · nxp/i.mx 6ulz firmware · nxp/i.mx 7dual firmware · nxp/i.mx 7solo firmware · nxp/i.mx 7ulp firmware · nxp/i.mx 8m mini firmware · nxp/i.mx 8m quad firmware · nxp/i.mx 8m vybrid firmware · nxp/i.mx rt1010 firmware · nxp/i.mx rt1015 firmware · +3 more

Source

cve@mitre.org

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.