CVE-2018-18558 Security feature bypass in n/a
A physically proximate attacker can bypass secure boot and execute arbitrary code in ESP-IDF if flash encryption is disabled or another write vulnerability exists.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18558?
CVE-2018-18558 is a medium-severity vulnerability in n/a, published on 13 May 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacker to bypass secure boot checks and execute arbitrary code, by crafting an application binary that overwrites a bootloader code segment in process_segment in components/bootloader_support/src/esp_image_format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory.
Weakness: CWE-20
Which versions are affected by CVE-2018-18558?
It affects 1 product.
Products include Espressif Esp-Idf.
How do I fix CVE-2018-18558?
No fix has been published for CVE-2018-18558 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-18558 being exploited?
There is no known exploitation of CVE-2018-18558 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-369v-4h43-wwr9.