CVE:CVE-2018-1000205
CNNVD:CNNVD-201806-1297
DENX Software Engineering U-Boot是德国DENX Software Engineering公司的一套可以从AES加密文件读取设备配置的引导加载程序。
DENX Software Engineering U-Boot中的Verified boot签名验证存在输入验证漏洞。攻击者可借助特制的FIT图像及设备内存功能利用该漏洞绕过签名检测。
solution:Upgrade denx u-boot to a higher version than 2018.07,and avoid the version (,2018.07]