PT-2019-9603 · Espressif · Esp-Idf

Published 2019-05-13 · Updated 2019-05-14 · CVE-2018-18558

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Espressif ESP-IDF versions 2.x through 3.0.5 Espressif ESP-IDF versions 3.1.x through 3.1.0

Description The issue is related to insufficient validation of input data in the 2nd stage bootloader, allowing a physically proximate attacker to bypass secure boot checks and execute arbitrary code. This can be achieved by crafting an application binary that overwrites a bootloader code segment in process segment in components/bootloader support/src/esp image format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory.

Recommendations For Espressif ESP-IDF versions 2.x through 3.0.5, update to version 3.0.6 or later. For Espressif ESP-IDF versions 3.1.x through 3.1.0, update to version 3.1.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-18558

Affected Products

Esp-Idf

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-18558 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18558 · Vendor Advisory
• https://github.com/espressif/esp-idf/releases · Note
• https://espressif.com/en/news/Espressif_Product_Security_Advisory_Concerning_Secure_Boot_%28CVE-2018-18558%29 · Note