Search criteria

2 vulnerabilities found for rauc by pengutronix

CVE-2020-25860 (GCVE-0-2020-25860)

Vulnerability from nvd – Published: 2020-12-21 17:23 – Updated: 2024-08-04 15:49
VLAI?
Summary
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
Severity ?
No CVSS data available.
CWE
  • CWE-367 - Time-of-Check Time-of-Use (CWE-367)
Assigner
References
Impacted products
Vendor Product Version
n/a Pengutronix RAUC Affected: All versions before 1.5
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:49:05.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pengutronix RAUC",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "All versions before 1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "Time-of-Check Time-of-Use (CWE-367)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-21T17:23:27",
        "orgId": "6b4ace4a-d6e0-415b-9ce8-aa20e97e4b24",
        "shortName": "VDOO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vuln@vdoo.com",
          "ID": "CVE-2020-25860",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Pengutronix RAUC",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions before 1.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Time-of-Check Time-of-Use (CWE-367)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv",
              "refsource": "MISC",
              "url": "https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv"
            },
            {
              "name": "https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework",
              "refsource": "MISC",
              "url": "https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b4ace4a-d6e0-415b-9ce8-aa20e97e4b24",
    "assignerShortName": "VDOO",
    "cveId": "CVE-2020-25860",
    "datePublished": "2020-12-21T17:23:27",
    "dateReserved": "2020-09-23T00:00:00",
    "dateUpdated": "2024-08-04T15:49:05.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2020-25860 (GCVE-0-2020-25860)

Vulnerability from cvelistv5 – Published: 2020-12-21 17:23 – Updated: 2024-08-04 15:49
VLAI?
Summary
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
Severity ?
No CVSS data available.
CWE
  • CWE-367 - Time-of-Check Time-of-Use (CWE-367)
Assigner
References
Impacted products
Vendor Product Version
n/a Pengutronix RAUC Affected: All versions before 1.5
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:49:05.940Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Pengutronix RAUC",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "All versions before 1.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "Time-of-Check Time-of-Use (CWE-367)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-12-21T17:23:27",
        "orgId": "6b4ace4a-d6e0-415b-9ce8-aa20e97e4b24",
        "shortName": "VDOO"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vuln@vdoo.com",
          "ID": "CVE-2020-25860",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Pengutronix RAUC",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions before 1.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Time-of-Check Time-of-Use (CWE-367)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv",
              "refsource": "MISC",
              "url": "https://github.com/rauc/rauc/security/advisories/GHSA-cgf3-h62j-w9vv"
            },
            {
              "name": "https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework",
              "refsource": "MISC",
              "url": "https://www.vdoo.com/blog/cve-2020-25860-significant-vulnerability-discovered-rauc-embedded-firmware-update-framework"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b4ace4a-d6e0-415b-9ce8-aa20e97e4b24",
    "assignerShortName": "VDOO",
    "cveId": "CVE-2020-25860",
    "datePublished": "2020-12-21T17:23:27",
    "dateReserved": "2020-09-23T00:00:00",
    "dateUpdated": "2024-08-04T15:49:05.940Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}