AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
| Link | Tags |
|---|---|
| https://github.com/linux4sam/at91bootstrap/commit/45419497309ffbf27c17ea7938499aca99168927 | third party advisory patch |
| https://labs.f-secure.com/advisories/microchip-at91bootstrap/ | third party advisory exploit |