Lucene search

MitreCVE-2020-11683

HistorySep 14, 2020 - 2:15 p.m.

CVE-2020-11683

2020-09-1414:15:10

CWE-203

mitre

web.nvd.nist.gov

at91bootstrap

timing side channel

vulnerability

exploit

physical access

cmac

arbitrary code

nvd

cve-2020-11683

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.8

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

41.5%

JSON

A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently boot arbitrary code on an affected system.

Affected configurations

Nvd

Node

linux4samat91bootstrapRange3.7.2–3.9.2

VendorProductVersionCPE
linux4samat91bootstrap*cpe:2.3:a:linux4sam:at91bootstrap:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux4sam	at91bootstrap	*	cpe:2.3:a:linux4sam:at91bootstrap::::::::

References

github.com/linux4sam/at91bootstrap/commit/7753914c9a622c245f3a3cf2af5e24b6a9904213

labs.f-secure.com/advisories/microchip-at91bootstrap/

Social References

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

6.8

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

41.5%

JSON

Related for CVE-2020-11683