Fault Injection Vulnerability in Espressif ESP-IDF Products

CVE-2019-15894

Summary

A vulnerability in Espressif ESP-IDF allows attackers to use fault injection techniques to disrupt the ESP32 CPU, enabling them to bypass Secure Boot and execute unverified code from flash memory. Although the presence of Flash Encryption can mitigate the risks when configured correctly, disabling it opens the door for arbitrary code execution. To enhance security, it is essential for devices to implement a firmware change that ensures Flash Encryption is permanently enabled if it has not been already, thereby reducing potential exposure to such attacks.

References