CVE-2023-45840 - Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847

Back Back to CVE browser

HIGH

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847

Published Dec 5, 2023

8.1

HIGH

CVSS 3.1

EPSS 0.81%

Description

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the `riscv64-elf-toolchain` package.

Affected products

Vendor Buildroot Product Buildroot Default
n/a
- Version
  2023.08.1
  Status
  affected
  Constraints
  -
- Version
  dev commit 622698d7847
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Buildroot

n/a

Version	Status	Constraints
2023.08.1	affected	-
dev commit 622698d7847	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-494

References (4)

http://www.openwall.com/lists/oss-security/2023/12/11/1
Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50110
Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844
ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1844

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2023/12/11/1		Mailing ListThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-50110		Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1844		ExploitThird Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1844