CVE-2014-4325: High severity Little Kernel Project Little Kernel Bootloader Android vulnerability

Published Aug 25, 2014

Updated

The cmdboot function in app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to bypass intended device-lock and kernel-signature restrictions by using fastboot mode in a boot command for an arbitrary kernel image.

Affected Software

1 affected component

Little Kernel Project Little Kernel Bootloader Android

Remediation

Patch Available

https://www.codeaurora.org/projects/security-advisories/fastboot-boot-command-bypasses-signature-verification-cve-2014-4325

Event History

Aug 25, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4325?

CVE-2014-4325 is classified as a high severity vulnerability due to its potential to allow unauthorized access to device functionality.

How do I fix CVE-2014-4325?

To fix CVE-2014-4325, update the Little Kernel bootloader to a patched version that addresses this vulnerability.

What devices are affected by CVE-2014-4325?

CVE-2014-4325 affects MSM devices utilizing the Little Kernel bootloader as part of Android contributions from Qualcomm Innovation Center.

Can CVE-2014-4325 be exploited remotely?

CVE-2014-4325 requires physical access to the device to exploit, as it involves using fastboot mode.

What are the potential impacts of exploiting CVE-2014-4325?

Exploiting CVE-2014-4325 can allow an attacker to bypass device lock and kernel signature restrictions, leading to unauthorized control of the device.