CVE-2024-38532
Severity:
HIGH
Type:
CWE-321
Use of Hard-coded Cryptographic Key
Publication date:
28/06/2024
Last modified:
28/06/2024
Description
The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its `-t` argument. This issue has been patched in commit 26a7.
Impact
Base Score 3.x
7.10
Severity 3.x
HIGH