« Volver al listado

CVE-2024-38532

Estado: AplazadaAlta (7.1)—

The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its `-t` argument. This issue has been patched in commit 26a7.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

NXP — Data Co-processorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38532",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38532",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-01T18:09:34.354875Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "usbarmory",
          "product": "mxs-dcp",
          "versions": [
            {
              "status": "affected",
              "version": ">= commit 6151, < commit 26a7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-06-28T22:15:03.157",
  "references": [
    {
      "url": "https://github.com/usbarmory/mxs-dcp/commit/e5a99cb3d9429e6145495da7d01525c75af426a7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/usbarmory/mxs-dcp/security/advisories/GHSA-g85c-rh49-p8cq",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/usbarmory/mxs-dcp/commit/e5a99cb3d9429e6145495da7d01525c75af426a7",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/usbarmory/mxs-dcp/security/advisories/GHSA-g85c-rh49-p8cq",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its `-t` argument. This issue has been patched in commit 26a7."
    },
    {
      "lang": "es",
      "value": "El coprocesador de datos (DCP) de NXP es un módulo de hardware integrado para SoC¹ de NXP específicos que implementa un motor criptográfico AES dedicado para operaciones de cifrado/descifrado. La implementación de referencia dcp_tool incluida en el repositorio seleccionó la clave de prueba, independientemente de su argumento `-t`. Este problema se solucionó en el commit 26a7."
    }
  ],
  "lastModified": "2026-06-17T07:40:29.030",
  "sourceIdentifier": "security-advisories@github.com"
}