PT-2019-9553 · Raspberry Pi Foundation · Raspberry Pi

Publicado 2019-04-04 · Atualizado 2019-10-03 · CVE-2018-18068

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Raspberry Pi 3 module B+ (affected versions not specified)

Description The issue concerns the ARM-based hardware debugging feature, which allows non-secure EL1 code to access and modify EL3 memory and registers. This is achieved through inter-processor debugging, where a debug host processor can halt a debug target processor and elevate its privilege level. As a result, the debug host gains full control over the target processor, enabling it to read and write any EL3 memory or register. This access also allows the execution of arbitrary code in EL3.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Exposure of Resource to Wrong Sphere

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

CVE-2018-18068

Produtos afetados

Raspberry Pi

Referências · 3

• 🔥 http://cs.wayne.edu/fengwei/paper/nailgun-sp19.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18068 · Nota de Segurança
• https://computer.org/csdl/proceedings-article/sp/2019/666000b157/17D45WHONhv · Nota