Severe Weakness in Microchip ASF Jeopardizes IoT Devices with Remote Code Execution Risk
An alarming security vulnerability has been revealed in the Microchip Advanced Software Framework (ASF) that, if exploited successfully, may result in remote code execution.
The vulnerability, known as CVE-2024-7490, comes with a CVSS score of 9.5 out of 10.0. It has been identified as a stack-based overflow flaw in ASF’s implementation of the tinydhcp server due to inadequate input validation.
“An issue is present in all publicly accessible instances of the ASF codebase that permits a specially crafted DHCP request to induce a stack-based overflow, which might lead to remote code execution,” CERT Coordination Center (CERT/CC) stated in a notice.
Given that the software is no longer maintained and is based on IoT-specific code, CERT/CC has cautioned that the vulnerability is “expected to emerge in numerous instances within the wild.”
The flaw affects ASF 3.52.0.2574 and all preceding versions of the software, with the agency also pointing out that several derivatives of the tinydhcp software are likely vulnerable to the flaw.
There are currently no solutions or countermeasures available to rectify CVE-2024-7490, except for substituting the tinydhcp service with an alternative that doesn’t harbor the same flaw.
This development coincides with SonicWall Capture Labs outlining a critical zero-click vulnerability impacting MediaTek Wi-Fi chipsets (CVE-2024-20017, CVSS 9.8) that could pave the way for remote code execution without needing any user intervention due to an out-of-bounds write anomaly.
“The impacted versions encompass MediaTek SDK versions 7.4.0.1 and earlier, in addition to OpenWrt 19.07 and 21.02,” the organization mentioned. “This includes a vast array of susceptive devices, such as routers and smartphones.”
“The flaw is a buffer overflow owing to a length parameter derived directly from packet data under the control of the attacker, without any boundary validation, and is placed into a memory copy. Such a buffer overflow triggers an out-of-bounds write.”
A fix for the vulnerability was issued by MediaTek in March 2024, although the likelihood of exploitation has risen with the public availability of a proof-of-concept (PoC) exploit as of August 30, 2024.
About Author
