CVE-2020-11684

AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).

AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).

AT91bootstrap versiones anteriores a 3.9.2, no limpia apropiadamente las claves de cifrado y autenticación de la memoria antes de pasar el control a un componente de software menos privilegiado. Esto puede ser explotado para revelar estas claves y posteriormente cifrar y firmar la siguiente etapa de arranque (tal y como el cargador de arranque)