What’s Vulnerable › Vulnerabilities

CVE-2020-11684

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-09-14 · updated 2026-06-17
• Weakness: CWE-212

Description

AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).

Affected products

• Linux4Sam At91Bootstrap: from 3.7.2 before 3.9.2 — fixed in 3.9.2

How to fix

Upgrade to a fixed version: Linux4Sam At91Bootstrap 3.9.2. Check the vendor advisory for mitigations.

References

• https://github.com/linux4sam/at91bootstrap/commit/45419497309ffbf27c17ea7938499aca99168927
• https://labs.f-secure.com/advisories/microchip-at91bootstrap/
• https://github.com/linux4sam/at91bootstrap/commit/45419497309ffbf27c17ea7938499aca99168927
• https://labs.f-secure.com/advisories/microchip-at91bootstrap/

Get alerted when CVE-2020-11684 or the next vulnerability affects your stack