CVE-2024-7726

Severity CVSS v4.0:

MEDIUM

Type:

CWE-306 Missing Authentication for Critical Function

Publication date:

20/12/2024

Last modified:

20/12/2024

Description

There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the drive’s circuit board. Due to the wide cutout of the enclosures, the JTAG port can be accessed without having to open the disk enclosure. Utilizing the JTAG debug port, an attacker with (temporary) physical access can get full access to the firmware and memory on the 2 main CPU cores within the drive including the execution of arbitrary code, the modification of firmware execution flow and data or bypassing the firmware signature verification during boot-up.

Impact

Vector 4.0

CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N CVSS v4.0 Severity and Metrics:

Base Score: 5.70 MEDIUM
Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Attack Vector (AV): Physical
Attack Complexity (AC): Low
Attack Requirements (AT): Present
Privileges Required (PR): None
User Interaction (UI): None
Confidentiality (VC): Low
Integrity (VI): High
Availability (VA): None
Confidentiality (SC): Low
Integrity (SI): High
Availability (SA): None

Base Score 4.0

5.70

Severity 4.0

MEDIUM

Vector 3.x

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 6.80 MEDIUM
Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Physical
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High

Base Score 3.x

6.80

Severity 3.x

MEDIUM

References to Advisories, Solutions, and Tools

https://github.com/google/security-research/security/advisories/GHSA-3hh8-94j4-62rh