CVE-2018-3968

An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2

High · published March 21, 2019

CVSS v3.0
8.2
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot.

The record
Technical detail
CVSS v3.0
8.2 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00276 · 18.9th percentile
Published
2019-03-21T16:36Z
EPSS history
Timeline
  • 21 MAR 16:36Z
    An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2
    cvelistv5