Vulnerability Details : CVE-2020-10648
Potential exploit
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration.
Vulnerability category: Input validation
Products affected by CVE-2020-10648
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
- cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*
- cpe:2.3:a:denx:u-boot:2020.01:-:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-10648
0.12%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 32 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-10648
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2020-10648
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-10648
-
https://labs.f-secure.com/advisories/das-u-boot-verified-boot-bypass/
Das U-Boot Verified Boot BypassExploit;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2020/03/18/5
oss-security - U-Boot verified boot improper signature verificationMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html
[security-announce] openSUSE-SU-2020:1869-1: important: Security updateThird Party Advisory
-
https://github.com/u-boot/u-boot/commits/master
Commits · u-boot/u-boot · GitHubPatch;Third Party Advisory
Jump to