Medium severity · published Sep 14, 2020
CVE-2020-11683
A timing side channel was discovered in AT91bootstrap before 3.9.2
6.8
CVSS
0.5%
EPSS
No
On KEV
Description
A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently boot arbitrary code on an affected system.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
At91bootstrap · Linux4sam
3.7.2 before 3.9.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11683
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11683
Patch
https://github.com/linux4sam/at91bootstrap/commit/7753914c9a622c245f3a3cf2af5e24b6a9904213
Exploit
https://labs.f-secure.com/advisories/microchip-at91bootstrap/
More from At91bootstrap
9.1
CVE-2020-11684
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component