Semtech LR11xx vulnerabilities

An out-of-bounds write vulnerability in the SPI host command interface of Semtech's LR11xx transceiver firmware. A crafted SPI host command with an oversized length field can cause the firmware to write up to 254 arbitrary bytes past the bounds of an internal, non-persistent memory buffer. Exploitation requires physical access to the device and logical access to the SPI bus.

Semtech LR11xx LoRa transceivers implement secure boot with a non-standard hashing algorithm vulnerable to second preimage attacks. An attacker with physical access can generate a malicious firmware image with a hash collision, bypassing secure boot and installing unauthorized firmware.

Semtech LR11xx LoRa transceivers with early firmware versions have an information disclosure vulnerability in firmware validation. After a firmware validity check command via SPI, the last decrypted block remains in memory, allowing an attacker with SPI access to read the decrypted firmware.