« Volver al listado

CVE-2018-3968

Estado: ModificadaAlta (7)—

An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Denx — U-boot

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-3968",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 8.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.5
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Das U-Boot",
          "versions": [
            {
              "status": "affected",
              "version": "Das U-Boot 2013.07-rc1 to 2014.07-rc2 OCTEON-SDK 3.1.2 to 5.1 CUJO Smart Firewall - Firmware version 7003"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-03-21T17:29:00.493",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0633",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0633",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad explotable en la protección verificada de arranque de Das U-Boot, desde la versión 2013.07-rc1 hasta la 2014.07-rc2. Las versiones afectadas carecen de una aplicación adecuada de las firmas FIT, lo que permite que un atacante omita el arranque verificado de U-Boot y ejecute un kernel sin firmar, embebido en un formato de imagen heredado. Para desencadenar esta vulnerabilidad, un atacante local necesita ser capaz de proporcionar la imagen de arranque."
    }
  ],
  "lastModified": "2026-06-17T01:58:08.010",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C8DB5B6-2A9F-44EA-B3DC-CDE840C14540",
              "versionEndIncluding": "2014.07",
              "versionStartIncluding": "2013.07"
            },
            {
              "criteria": "cpe:2.3:a:denx:u-boot:2013.07:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C787638-BDD7-485A-B024-803B9651D54A"
            },
            {
              "criteria": "cpe:2.3:a:denx:u-boot:2013.07:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD7B4F31-7C15-4EF6-9E09-923C0A396415"
            },
            {
              "criteria": "cpe:2.3:a:denx:u-boot:2013.07:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6179563-B4D6-4521-B7D3-89A2A8EC48A7"
            },
            {
              "criteria": "cpe:2.3:a:denx:u-boot:2014.07:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9356F059-9AE8-4A34-9B94-7690E068F212"
            },
            {
              "criteria": "cpe:2.3:a:denx:u-boot:2014.07:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D588DDD7-46D5-4BFF-9732-DEE4DEDC4D39"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}