CVE-2018-18068
The ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other devices allows non-secure EL1 code to read/write any EL3 (the highest privilege level in ARMv8) memory/register via inter-processor debugging.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.33%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The ARM-based hardware debugging feature on Raspberry Pi 3 module B+ and possibly other devices allows non-secure EL1 code to read/write any EL3 (the highest privilege level in ARMv8) memory/register via inter-processor debugging. With a debug host processor A running in non-secure EL1 and a debug target processor B running in any privilege level, the debugging feature allows A to halt B and promote B to any privilege level. As a debug host, A has full control of B even if B owns a higher privilege level than A. Accordingly, A can read/write any EL3 memory/register via B. Also, with this memory access, A can execute arbitrary code in EL3.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.33% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-668
- Affected
- raspberrypi/raspberry pi 3 model b\+ firmware
- Source
- cve@mitre.org
References
- http://www.cs.wayne.edu/fengwei/paper/nailgun-sp19.pdfExploit, Technical Description, Third Party Advisory
- https://www.computer.org/csdl/proceedings-article/sp/2019/666000b157/17D45WHONhvThird Party Advisory
- http://www.cs.wayne.edu/fengwei/paper/nailgun-sp19.pdfExploit, Technical Description, Third Party Advisory
- https://www.computer.org/csdl/proceedings-article/sp/2019/666000b157/17D45WHONhvThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.