CVE-2024-38532
Severity CVSS v4.0:
Pending analysis
Type:
CWE-321
Use of Hard-coded Cryptographic Key
Publication date:
28/06/2024
Last modified:
01/07/2024
Description
The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its `-t` argument. This issue has been patched in commit 26a7.
Impact
Base Score 3.x
7.10
Severity 3.x
HIGH