Time-of-Check to Time-of-Use Vulnerability in RK3588s SoC Secure BootROM

CVE-2024-13942

What is CVE-2024-13942?

The RK3588s System on Chip (SoC) features a Secure BootROM that is susceptible to time-of-check to time-of-use (TOCTOU) attacks when booting from external media like SPI NOR, NAND, EMMC, or SD cards. The vulnerability arises from the mechanism where the next-stage loader's header is read twice, first partially and then entirely. The initial read includes only the hashes of the executable modules, while the complete read validates the signature. However, this design flaw allows an attacker with physical access to manipulate the next-stage loader data on-the-fly using cost-effective emulators. This could lead to arbitrary code execution at the highest privilege level (EL3), significantly compromising device security. Users are advised to apply mitigations as per vendor instructions or cease use of the affected products immediately.

References