CVE-2020-10648

7.8 HIGH

Published: March 19, 2020 Modified: May 12, 2026

Description

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2020/03/18/5

Source: cve@mitre.org

Mailing List Third Party Advisory

https://github.com/u-boot/u-boot/commits/master

Source: cve@mitre.org

Patch Third Party Advisory

https://labs.f-secure.com/advisories/das-u-boot-verified-boot-bypass/

Source: cve@mitre.org

Exploit Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00030.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.openwall.com/lists/oss-security/2020/03/18/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List Third Party Advisory

https://github.com/u-boot/u-boot/commits/master

Source: af854a3a-2127-422b-91ae-364da2661108

Patch Third Party Advisory

https://labs.f-secure.com/advisories/das-u-boot-verified-boot-bypass/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit Third Party Advisory

https://cert-portal.siemens.com/productcert/html/ssa-577017.html

Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

9 reference(s) from NVD

Quick Stats

CVSS v3 Score

7.8 / 10.0

EPSS (Exploit Probability)

1.3%

67th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-20

Affected Vendors

denx opensuse

Related CVEs