CVE-2021-38545 Information disclosure in n/a
Remote attackers can recover audio signals from Raspberry Pi speakers by analyzing power indicator LED fluctuations via optical sensors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-38545?
CVE-2021-38545 is a medium-severity vulnerability in n/a, published on 11 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Raspberry Pi 3 B+ and 4 B devices through 2021-08-09, in certain specific use cases in which the device supplies power to audio-output equipment, allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. We assume that the Raspberry Pi supplies power to some speakers. The power indicator LED of the Raspberry Pi is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played by the speakers affects the Raspberry Pi's power consumption and as a result is also correlative to the light intensity of the LED. By analyzing measurements obtained from an electro-optical sensor directed at the power indicator LED of the Raspberry Pi, we can recover the sound played by the speakers.
Which versions are affected by CVE-2021-38545?
It affects 2 products.
Products include Raspberrypi Raspberry Pi 3 Model B\+ Firmware, Raspberrypi Raspberry Pi 4 Model B Firmware.
How do I fix CVE-2021-38545?
No fix has been published for CVE-2021-38545 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-38545 being exploited?
There is no known exploitation of CVE-2021-38545 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w4r6-6p34-f36w.