FIP Header Integer Overflow

Secure boot is a security standard developed to help make sure that a device boots using only software that is trusted by the Original Equipment Manufacturer (OEM). When the device starts, the firmware checks the signature of each piece of boot software. If the signatures are valid, the device boots, and the firmware gives control to the operating system.

During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each image, the bl2 reads the image length and destination from the image’s certificate. The destination is the memory address in ram into which the image will be loaded to. It then loads the image to the destination memory address and verifies the certificate and the image.

When reading the image length from the certificate, a 32-bit unsigned integer value is being read, multiplied by four, and saved into another 32-bit unsigned integer. This can result in an integer overflow.

Later on, this value (together with the destination address) is used to check that the image will not be loaded outside a certain allowed memory range. While copying the data the same size is used and the same overflow happens again and so no buffer overflow occurs and no security risk is posed at the moment.

This vulnerability still should be fixed.

Preconditions

The ability to write to the flash area used by the bootloader.

Threat

An attacker can bypass memory range restriction and write data out of buffer bounds, which could result in bypass of secure boot. 

Recommendations

Check against overflows while calculating the len.

Attack Rating

Expertise: Expert

Access: Moderate

Time: Decades

Equipment: Specialized

Knowledge: Public

CWE: 190

Affected Technology: program code execution

Affected Security Goal: ECU availability