CVE-2026-46728: Das U-Boot FIT签名验证绕过漏洞

#!/usr/bin/env python3 """ PoC Concept for CVE-2026-46728 This script demonstrates the logic of the vulnerability where hashed-nodes are omitted from the signature calculation, allowing for bypass. """ def verify_signature_vulnerable(fit_image, signature): # Simulated vulnerable verification logic calculated_hash = hashlib.sha256() # In the vulnerable version (U-Boot < 2026.04), specific nodes are skipped # during hashing, represented here as 'hashed-nodes' for node in fit_image.nodes: if node.name == "hashed-nodes": continue # VULNERABILITY: Skipping the node calculated_hash.update(node.data) return calculated_hash.digest() == signature def verify_signature_secure(fit_image, signature): # Secure logic hashes all relevant nodes calculated_hash = hashlib.sha256() for node in fit_image.nodes: calculated_hash.update(node.data) return calculated_hash.digest() == signature # Attack Scenario: # 1. Attacker modifies the content of 'hashed-nodes' in the FIT image. # 2. The signature remains unchanged because it was calculated without this node. # 3. verify_signature_vulnerable returns True, bypassing secure boot. print("PoC: Modifying hashed-nodes bypasses verification in vulnerable versions.")