What is CVE-2014-0973?

CVE-2014-0973 is a vulnerability in Little Kernel Project Bootloader, classified under Improper Authentication. Published 2014-08-25.

Is CVE-2014-0973 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Little Kernel Project Bootloader

CVE-2014-0973

The image_verify function in platform/msm_shared/image_verify.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not check whether a certain digest size is consistent with the RSA_public_decrypt API specification, which makes it easier for attackers to bypass boot-image authentication requirements via trailing data.

Vulnerability class: Broken Authentication

EPSS: 0.004 (31.0th percentile) — read the EPSS interpretation.

Affected products

Little_kernel_project Little_kernel_bootloader
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

Public proof-of-concept exploits

References

cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (x_refsource_CONFIRM, Patch)

Frequently asked questions

What is CVE-2014-0973?: CVE-2014-0973 is a vulnerability in Little Kernel Project Bootloader, classified under Improper Authentication. Published 2014-08-25.
Is CVE-2014-0973 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.