CVE-2017-3226 Das U-Boot's AES-CBC encryption feature improperly handles an error condition and may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data
MediumCVSS 6.4
EPSS 0.27%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC encryption feature using environment encryption (i.e., setting the configuration parameter CONFIG_ENV_AES=y) read environment variables from disk as the encrypted disk image is processed. An attacker with physical access to the device can manipulate the encrypted environment data to include a crafted two-byte sequence which triggers an error in environment variable parsing. This error condition is improperly handled by Das U-Boot, resulting in an immediate process termination with a debugging message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/u-boot(Debian:12) | All versions | No fix listed |
| debian/u-boot(Debian:12) | = 2023.01+dfsg-2 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.01+dfsg-2+deb12u1 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.01+dfsg-2+deb12u2 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.01+dfsg-2+deb12u3 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.04+dfsg-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.04~rc2+dfsg-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.04~rc5+dfsg-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.07+dfsg-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.07~rc4+dfsg-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2023.07~rc5+dfsg-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01+dfsg-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01+dfsg-2 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01+dfsg-3 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01+dfsg-4 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01+dfsg-5 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01+dfsg-6 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01+dfsg-7 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01~rc6+dfsg-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2024.01~rc6+dfsg-2 | No fix listed |
| debian/u-boot(Debian:12) | = 2025.01-1 | No fix listed |
| debian/u-boot(Debian:12) | = 2025.01-2 | No fix listed |
| debian/u-boot(Debian:12) | = 2025.01-3 | No fix listed |
| debian/u-boot(Debian:12) | = 2025.01-3.1 | No fix listed |
| debian/u-boot(Debian:12) | = 2025.01-3.2 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/u-boot(Debian:13) | All versions | No fix listed |
| debian/u-boot(Debian:13) | = 2025.01-3 | No fix listed |
| debian/u-boot(Debian:13) | = 2025.01-3+deb13u1 | No fix listed |
| debian/u-boot(Debian:13) | = 2025.01-3.1 | No fix listed |
| debian/u-boot(Debian:13) | = 2025.01-3.2 | No fix listed |
| debian/u-boot(Debian:14) | All versions | No fix listed |
| debian/u-boot(Debian:14) | = 2025.01-3 | No fix listed |
| debian/u-boot(Debian:14) | = 2025.01-3.1 | No fix listed |
| debian/u-boot(Debian:14) | = 2025.01-3.2 | No fix listed |
| denx U-Boot | < 2017.09 | 2017.09 |
| das U-Boot | >= 2017.09, < 2017.09 | 2017.09 |
References
- Debian Security Tracker CVE-2017-3226 vendor-advisory
- 100675 third-party-advisory vdb-entry
- VU#166743 third-party-advisory us-government-resource