Vulnerability Details : CVE-2020-11684
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
Products affected by CVE-2020-11684
- cpe:2.3:a:linux4sam:at91bootstrap:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-11684
0.37%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 72 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-11684
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST | |
|
9.1
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
3.9
|
5.2
|
NIST |
CWE ids for CVE-2020-11684
-
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-11684
-
https://github.com/linux4sam/at91bootstrap/commit/45419497309ffbf27c17ea7938499aca99168927
driver: secure: move keys into static arrays · linux4sam/at91bootstrap@4541949 · GitHubPatch;Third Party Advisory
-
https://labs.f-secure.com/advisories/microchip-at91bootstrap/
Microchip AT91Bootstrap Code Authentication IssuesExploit;Third Party Advisory
Jump to