Vulnerability Description
An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Denx | U-Boot | >= 2013.07, <= 2014.07 |
Related Weaknesses (CWE)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0633ExploitThird Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0633ExploitThird Party Advisory
FAQ
What is CVE-2018-3968?
CVE-2018-3968 is a vulnerability with a CVSS score of 7.0 (HIGH). An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows...
How severe is CVE-2018-3968?
CVE-2018-3968 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-3968?
Check the references section above for vendor advisories and patch information. Affected products include: Denx U-Boot.