Vulnerability · Published May 16, 2024 · Assigned by Microchip

CVE-2024-4760Voltage glitch during startup of the EEFC NVM controller can bypass the security bit

Medium 6.3

In plain English

A medium-severity security flaw in SAM3N from Microchip. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 88.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.

Affected products (as reported)

Vendor	Product	Versions
Microchip	SAME70	0
Microchip	SAMS70	0
Microchip	SAMV70	0
Microchip	SAMV71	0
Microchip	SAMG55	0
Microchip	SAM4C	0
Microchip	SAM4S	0
Microchip	SAM4N	0
Microchip	SAM4E	0
Microchip	SAM3S	0
Microchip	SAM3N	0
Microchip	SAM3U	0

Weakness: CWE-1247 · Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/ technical-description, exploit
https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocuments/SupportingCollateral/Security-Advisory-CVE-2024-4760.pdf vendor-advisory