Bug 1058437 (CVE-2017-3225) - VUL-0: CVE-2017-3225: u-boot: Not Using a Random IV with CBC Mode
Summary: VUL-0: CVE-2017-3225: u-boot: Not Using a Random IV with CBC Mode
Status: RESOLVED INVALID
Alias: CVE-2017-3225
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Assignee: Andreas Färber
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2017-09-13 06:47 UTC by Alexander Bergmann
Modified: 2017-09-13 07:18 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2017-09-13 06:47:06 UTC 
CWE-329: Not Using a Random IV with CBC Mode - CVE-2017-3225

Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.

References:
https://www.kb.cert.org/vuls/id/166743
Comment 1 Guillaume GARDET 2017-09-13 06:52:09 UTC 
It is not a real problem since this code is not used inside U-Boot and will be removed in the next releases.
See: https://lists.denx.de/pipermail/u-boot/2017-September/305181.html
Comment 2 Alexander Bergmann 2017-09-13 07:18:49 UTC 
Neither SLE nor openSUSE is using the AES encryption inside u-boot.

Closing as invalid.