Timing Information Leak in Pengutronix Barebox

CVE-2021-37847

What is CVE-2021-37847?

A flaw exists in Pengutronix Barebox, where the use of memcmp for digest verification exposes timing information. This leakage can be exploited by attackers to infer sensitive data based on timing discrepancies, potentially leading to unauthorized access or exposure of cryptographic keys. Addressing this issue is crucial for maintaining the integrity and security of the affected system.

References