Executive brief
Das U-Boot is a widely used bootloader responsible for starting the operating system on embedded devices and ensuring that only authorized software is allowed to run. A security flaw allows an attacker to bypass these "verified boot" protections by providing a specially crafted image file. If exploited, this allows the execution of unauthorized or malicious software on the device, potentially leading to a full system compromise or persistent malware installation.
Technical details
A vulnerability exists in U-Boot's verified boot implementation for Flattened Image Tree (FIT) images. The root cause is improper input validation where U-Boot fails to verify that the 'hashed-nodes' property in a signature node actually corresponds to the sub-images (kernel, FDT, ramdisk) defined in the configuration. An attacker can craft a FIT image that includes a malicious configuration referencing unauthorized sub-images while reusing a valid signature from a legitimate configuration. If the system is configured to boot a default configuration that the attacker has modified, U-Boot will validate the signature against the original nodes but proceed to boot the attacker's unauthorized images. This bypasses the chain of trust intended by the verified boot feature.
Affected products
- Denx U-Boot through 2020.01
Timeline
- 2020-01-22: other: Vulnerability discovered by F-Secure
- 2020-03-18: disclosed: Public disclosure via oss-security mailing list
- 2020-03-19: advisory: NVD published CVE-2020-10648
- 2020-03-17: patched: Patches submitted to U-Boot master branch
References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html
- http://www.openwall.com/lists/oss-security/2020/03/18/5
- https://github.com/u-boot/u-boot/commits/master
- https://labs.f-secure.com/advisories/das-u-boot-verified-boot-bypass/
- https://cert-portal.siemens.com/productcert/html/ssa-577017.html