CVE-2020-11684

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-212

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/linux4sam/at91bootstrap/commit/45419497309ffbf27c17ea7938499aca99168927Patch, Third Party Advisory
https://labs.f-secure.com/advisories/microchip-at91bootstrap/Exploit, Third Party Advisory
https://github.com/linux4sam/at91bootstrap/commit/45419497309ffbf27c17ea7938499aca99168927Patch, Third Party Advisory
https://labs.f-secure.com/advisories/microchip-at91bootstrap/Exploit, Third Party Advisory

Timeline

Published: Sep 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-116857.5In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.CVE-2020-116862.7In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.CVE-2020-116877.5In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages.CVE-2020-116887.5In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.CVE-2020-116896.5In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file.CVE-2020-11697.8<p>An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfull CVE-2020-116909.8In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases.CVE-2020-116917.5In JetBrains Hub before 2020.1.12099, content spoofing in the Hub OAuth error message was possible.CVE-2020-116922.7In JetBrains YouTrack before 2020.1.659, DB export was accessible to read-only administrators.CVE-2020-116937.5JetBrains YouTrack before 2020.1.659 was vulnerable to DoS that could be caused by attaching a malformed TIFF file to an issue.CVE-2020-116947.5In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 201 CVE-2020-116966.1In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, p