android-hardware-attestation-demo

Android 硬件认证绕过 — 演示 本仓库是 Quarkslab 文章 的配套代码，该文章介绍 Android 硬件密钥认证（hardware Key Attestation），本仓库用于对其进行说明。 这是一个小型的端到端概念验证（proof of concept），展示了一种简单的绕过方式：已 root 手机上的分析人员通过将认证中继 到第二台干净设备，从而绕过后端的硬件认证检查。整个过程没有任何伪造。由未经修改的设备生成、且绑定到后端自身 nonce 的真实认证链，会被转发以替代已 root 设备被拒绝的认证链。 适用范围与伦理。 这是面向安全研究的教育材料。它使用明文...

test_avb_key

论 几乎 签名 Android 构建 引言 NCC Group 的顾问偶尔会遇到这样的问题：Android 构建使用了已知的私钥进行签名。这使设备制造商（以及他们的用户）暴露在风险之中，即使在启用了安全启动（secure boot）的设备上也是如此。这篇博文有两个目标： 提高对这一问题的认识 介绍一个脚本，用作快速检查，以验证 Android 构建是否（错误地）使用了已知私钥签名。 当基于 Android 的设备启动时，首先会验证引导加载程序（bootloader）运行的是已签名的代码，随后引导加载程序验证高级操作系统（HLOS）。这篇博文仅涉及后者。 保护引导加载程序 – 简要概述...

Astra Linux – Vulnerability in u-boot

The U-Boot until 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration...

CVE-2026-6484

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-6484

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-6484 Lack of verified boot to certain FV may cause arbitrary code execution

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-6484

CVE-2026-6484 concerns UEFI firmware where lack of verified boot for certain FV enables arbitrary code execution. The available data indicates a local attack vector with high privileges required and high impact on confidentiality, integrity, and availability (per CVSS 3.1 vector: AV:L/AC:L/PR:H/U...

EUVD-2026-57052

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-6484 Lack of verified boot to certain FV may cause arbitrary code execution

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

PT-2026-70961

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

CVE-2026-6484: Firmware Not Updateable

In an UEFI, Lack of verified boot to certain FV may cause arbitrary code execution...

Siemens RuggedCom Rox Improper Input Validation (CVE-2020-10648)

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration. This plugin only works with Tenable.ot. Please visit...

CVE-2026-0142

In iavbparsekeydata of avbrsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-47222

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser in NanaZip via the upstream 7-Zip AvbHandler. An unsigned integer underflow in a...

CVE-2026-47223 NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser in NanaZip via the upstream 7-Zip AvbHandler. A 32-bit unsigned integer overflow ...

CVE-2026-47223 NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser in NanaZip via the upstream 7-Zip AvbHandler. A 32-bit unsigned integer overflow ...

CVE-2026-47223 NanaZip: Heap out-of-bounds read in NanaZip AVB hashtree descriptor parser via 32-bit unsigned integer overflow

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser in NanaZip via the upstream 7-Zip AvbHandler. A 32-bit unsigned integer overflow ...

CVE-2026-47222 NanaZip: Heap out-of-bounds read in NanaZip AVB property descriptor parser via unsigned integer underflow

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser in NanaZip via the upstream 7-Zip AvbHandler. An unsigned integer underflow in a...

CVE-2026-47222 NanaZip: Heap out-of-bounds read in NanaZip AVB property descriptor parser via unsigned integer underflow

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser in NanaZip via the upstream 7-Zip AvbHandler. An unsigned integer underflow in a...

EUVD-2026-36506

NanaZip is the 7-Zip derivative intended for the modern Windows experience. From version 3.0.1000.0 to before version 6.0.1698.0, a heap out-of-bounds read exists in the Android Verified Boot AVB vbmeta image parser in NanaZip via the upstream 7-Zip AvbHandler. An unsigned integer underflow in a...