CVE-2017-3225
Medium
Description
Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.
SeverityMedium
CVSS4.6
Exploit probability—
ProductDenx U-boot
PublishedJul 24, 2018
First seenJul 24, 2018
Weakness typeCWE-329CWE-329
How to fix
Update
- denx u-boot2017.09 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| denx u-boot | v < 2017.09 | 2017.09 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.