Critical severity · published Sep 14, 2020
CVE-2020-11684
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component
9.1
CVSS
1.1%
EPSS
No
On KEV
Description
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
At91bootstrap · Linux4sam
3.7.2 before 3.9.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11684
Patch
https://github.com/linux4sam/at91bootstrap/commit/45419497309ffbf27c17ea7938499aca99168927
Exploit
https://labs.f-secure.com/advisories/microchip-at91bootstrap/
More from At91bootstrap
6.8
CVE-2020-11683
A timing side channel was discovered in AT91bootstrap before 3.9.2