Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.
CVSS Details
CVSS Score
8.2
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Das U-Boot < 2026.04
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
PoC Concept for CVE-2026-46728
This script demonstrates the logic of the vulnerability where hashed-nodes
are omitted from the signature calculation, allowing for bypass.
"""
def verify_signature_vulnerable(fit_image, signature):
# Simulated vulnerable verification logic
calculated_hash = hashlib.sha256()
# In the vulnerable version (U-Boot < 2026.04), specific nodes are skipped
# during hashing, represented here as 'hashed-nodes'
for node in fit_image.nodes:
if node.name == "hashed-nodes":
continue # VULNERABILITY: Skipping the node
calculated_hash.update(node.data)
return calculated_hash.digest() == signature
def verify_signature_secure(fit_image, signature):
# Secure logic hashes all relevant nodes
calculated_hash = hashlib.sha256()
for node in fit_image.nodes:
calculated_hash.update(node.data)
return calculated_hash.digest() == signature
# Attack Scenario:
# 1. Attacker modifies the content of 'hashed-nodes' in the FIT image.
# 2. The signature remains unchanged because it was calculated without this node.
# 3. verify_signature_vulnerable returns True, bypassing secure boot.
print("PoC: Modifying hashed-nodes bypasses verification in vulnerable versions.")