PT-2020-16248 · Pengutronix · Pengutronix Rauc Update Client
Published
2020-12-21
·
Updated
2020-12-29
·
CVE-2020-25860
CVSS v2.0
7.1
High
| Vector | AV:N/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Pengutronix RAUC update client versions prior to 1.5
Description
The install.c module in the Pengutronix RAUC update client has a Time-of-Check Time-of-Use vulnerability. This issue occurs because signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
Recommendations
For versions prior to 1.5, update to version 1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the update file to prevent modification during the installation process.
Exploit
Fix
Time Of Check To Time Of Use
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pengutronix Rauc Update Client