CVE-2018-1000205 (Medium) detected in ubootrelease-20161011, ubootv2016.09.01

[mend-bolt-for-github]

CVE-2018-1000205 - Medium Severity Vulnerability

Vulnerable Libraries - ubootrelease-20161011, ubootv2016.09.01

Vulnerability Details

U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack appear to be exploitable via Specially crafted FIT image and special device memory functionality.

Publish Date: 2018-06-26

URL: CVE-2018-1000205

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-06-26

Fix Resolution: v2018.09-rc1

---

Step up your Open Source Security Game with Mend here