# CVE-2020-10648: Denx Das U-Boot verified boot bypass in FIT image parsing

Source: https://junglewise.ai/threats/cve-2020-10648-denx-das-u-boot-verified-boot-bypass-in-fit-image-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-03-19. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2020-10648 · Severity: high · CVSS 7.8 · Published 2020-03-19

Das U-Boot is a widely used bootloader responsible for starting the operating system on embedded devices and ensuring that only authorized software is allowed to run. A security flaw allows an attacker to bypass these "verified boot" protections by providing a specially crafted image file. If exploited, this allows the execution of unauthorized or malicious software on the device, potentially leading to a full system compromise or persistent malware installation.

## Quick answers

**Is CVE-2020-10648 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-10648 being exploited in the wild.

**How severe is CVE-2020-10648?** High severity, with a CVSS score of 7.8, published 19 March 2020.

**Which products and versions are affected?** Denx U-Boot through 2020.01.

**Is there a fix for CVE-2020-10648?** A patch was published on 2020-03-17: Patches submitted to U-Boot master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-10648 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2020-10648?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in U-Boot's verified boot implementation for Flattened Image Tree (FIT) images. The root cause is improper input validation where U-Boot fails to verify that the 'hashed-nodes' property in a signature node actually corresponds to the sub-images (kernel, FDT, ramdisk) defined in the configuration. An attacker can craft a FIT image that includes a malicious configuration referencing unauthorized sub-images while reusing a valid signature from a legitimate configuration. If the system is configured to boot a default configuration that the attacker has modified, U-Boot will validate the signature against the original nodes but proceed to boot the attacker's unauthorized images. This bypasses the chain of trust intended by the verified boot feature.

## Affected products

- Denx U-Boot through 2020.01

## Timeline

- 2020-01-22: other: Vulnerability discovered by F-Secure
- 2020-03-18: disclosed: Public disclosure via oss-security mailing list
- 2020-03-19: advisory: NVD published CVE-2020-10648
- 2020-03-17: patched: Patches submitted to U-Boot master branch

## References

- [http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html](http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html)
- [http://www.openwall.com/lists/oss-security/2020/03/18/5](http://www.openwall.com/lists/oss-security/2020/03/18/5)
- [https://github.com/u-boot/u-boot/commits/master](https://github.com/u-boot/u-boot/commits/master)
- [https://labs.f-secure.com/advisories/das-u-boot-verified-boot-bypass/](https://labs.f-secure.com/advisories/das-u-boot-verified-boot-bypass/)
- [https://cert-portal.siemens.com/productcert/html/ssa-577017.html](https://cert-portal.siemens.com/productcert/html/ssa-577017.html)