Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2018-3968 Details

Description

An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0633 CVEExploitThird Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0633 [email protected]ExploitThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-347Improper Verification of Cryptographic Signature[email protected]

Affected Products

ProductVersions
denx u-boot
>= 2013.07, <= 2014.07
2013.07 rc1
2013.07 rc2
2013.07 rc3
2014.07 rc1

CPE

  • cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*
  • cpe:2.3:a:denx:u-boot:2013.07:rc1:*:*:*:*:*:*
  • cpe:2.3:a:denx:u-boot:2013.07:rc2:*:*:*:*:*:*
  • cpe:2.3:a:denx:u-boot:2013.07:rc3:*:*:*:*:*:*
  • cpe:2.3:a:denx:u-boot:2014.07:rc1:*:*:*:*:*:*
  • cpe:2.3:a:denx:u-boot:2014.07:rc2:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2018-3968
NVD Published Date:
Mar 21, 2019
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2018-3968 Details - Not Deferred