SB2019100726 - Improper Neutralization of Special Elements in Output Used by a Downstream Component in ESP-IDF

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019100726

SB2019100726 - Improper Neutralization of Special Elements in Output Used by a Downstream Component in ESP-IDF

Published: October 7, 2019 Updated: July 17, 2020

Security Bulletin ID SB2019100726
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Physical access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2019-15894)

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. An attacker who uses fault injection to physically disrupt the ESP32 CPU can bypass the Secure Boot digest verification at startup, and boot unverified code from flash. The fault injection attack does not disable the Flash Encryption feature, so if the ESP32 is configured with the recommended combination of Secure Boot and Flash Encryption, then the impact is minimized. If the ESP32 is configured without Flash Encryption then successful fault injection allows arbitrary code execution. To protect devices with Flash Encryption and Secure Boot enabled against this attack, a firmware change must be made to permanently enable Flash Encryption in the field if it is not already permanently enabled.


Remediation

Install update from vendor's website.

References