This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-3968 →

DEBIAN-CVE-2018-3968

An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions l...

Original description

The description as published by the source.

An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 u-boot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.07+dfsg1-1"}]}]

Debian:13 u-boot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.07+dfsg1-1"}]}]

Debian:14 u-boot

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.07+dfsg1-1"}]}]

References

advisory security-tracker.debian.org