CVE Vulnerability

CVE-2018-1000205

U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack appear to be exploitable via Specially crafted FIT image and special device memory functionality.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.denx.de/pipermail/u-boot/2018-June/330898.html Mitigation Mailing List
https://lists.denx.de/pipermail/u-boot/2018-June/330454.html Mailing List Patch
Configurations

Configuration 1

cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*
Information

Published : 2018-06-26 04:29

Updated : 2020-10-22 02:01

NVD link : CVE-2018-1000205

Mitre link : CVE-2018-1000205

Products Affected
No products.
CWE
CWE-20