CVE-2020-11684 AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these...
CriticalCVSS 9.1
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux4sam at91bootstrap | >= 3.7.2, < 3.9.2 | 3.9.2 |
References
- github.com patch third-party-advisory
- labs.f-secure.com exploit third-party-advisory