Input validation error in Universal Boot Loader (U-Boot) - CVE-2018-1000205
Published: June 26, 2018 / Updated: August 8, 2020
Vulnerability identifier: #VU37003
CSH Severity: Medium
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1000205
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack appear to be exploitable via Specially crafted FIT image and special device memory functionality.
Affected software
Universal Boot Loader (U-Boot)
How to mitigate CVE-2018-1000205
Install update from vendor's website.