CVE-2023-39902

HIGH EPSS 4.1%
Published Oct 17, 20232y ago · Modified Jun 17, 20262w ago
7.8 CVSS 3.1
High
Find Similar
Published Oct 17, 2023 2y ago
Last Modified Jun 17, 2026 2w ago

Description

A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
4.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-281

Affected Products 5

VendorProductVersionRange
nxpuboot_secondary_program_loader* <2023.07
nxpi.mx_8m*any
nxpi.mx_8m_mini*any
nxpi.mx_8m_nano*any
nxpi.mx_8m_plus*any

References 2

  • community.nxp.com https://community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196
    MitigationPatchVendor Advisory
  • nxp.com https://nxp.com
    Product

Remediation

  • community.nxp.com https://community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196
    MitigationPatchVendor Advisory