9.1

CVE-2020-11684

Exploit
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux4sam ≫ At91bootstrap Version >= 3.7.2 < 3.9.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.08% 0.606
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

https://labs.f-secure.com/advisories/microchip-at91bootstrap/
Third Party Advisory
Exploit
https://github.com/linux4sam/at91bootstrap/commit/45419497309ffbf27c17ea7938499aca99168927
Patch
Third Party Advisory