Is CVE-2020-10648 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-10648 being exploited in the wild.

How severe is CVE-2020-10648?

High severity, with a CVSS score of 7.8, published 19 March 2020.

Is there a fix for CVE-2020-10648?

A patch was published on 2020-03-17: Patches submitted to U-Boot master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-10648 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2020-10648?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-10648: Denx Das U-Boot verified boot bypass in FIT image parsing

CVE-2020-10648 · Severity: high · CVSS 7.8 · Published 2020-03-19

Das U-Boot is a widely used bootloader responsible for starting the operating system on embedded devices and ensuring that only authorized software is allowed to run. A security flaw allows an attacker to bypass these "verified boot" protections by providing a specially crafted image file. If exploited, this allows the execution of unauthorized or malicious software on the device, potentially leading to a full system compromise or persistent malware installation.

Quick answers

Is CVE-2020-10648 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-10648 being exploited in the wild.
How severe is CVE-2020-10648?: High severity, with a CVSS score of 7.8, published 19 March 2020.
Which products and versions are affected?: Denx U-Boot through 2020.01.
Is there a fix for CVE-2020-10648?: A patch was published on 2020-03-17: Patches submitted to U-Boot master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-10648 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2020-10648?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in U-Boot's verified boot implementation for Flattened Image Tree (FIT) images. The root cause is improper input validation where U-Boot fails to verify that the 'hashed-nodes' property in a signature node actually corresponds to the sub-images (kernel, FDT, ramdisk) defined in the configuration. An attacker can craft a FIT image that includes a malicious configuration referencing unauthorized sub-images while reusing a valid signature from a legitimate configuration. If the system is configured to boot a default configuration that the attacker has modified, U-Boot will validate the signature against the original nodes but proceed to boot the attacker's unauthorized images. This bypasses the chain of trust intended by the verified boot feature.

Affected products

Denx U-Boot through 2020.01

Timeline

2020-01-22: other: Vulnerability discovered by F-Secure
2020-03-18: disclosed: Public disclosure via oss-security mailing list
2020-03-19: advisory: NVD published CVE-2020-10648
2020-03-17: patched: Patches submitted to U-Boot master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.