CVE-2014-0973
HighSummary
The image_verify function in the Little Kernel (LK) bootloader does not check whether a certain digest size is consistent with the RSA_public_decrypt API specification, allowing attackers to bypass boot-image authentication requirements via trailing data.
Risk Assessment
Organizations may be vulnerable to attacks that allow unauthorized software to run on Android devices, potentially leading to data loss or device takeover.
Recommendation
It is recommended to update the bootloader to the latest version that improves digest size verification to prevent the possibility of bypassing boot-image authentication.
Other vulnerabilities in Little Kernel (LK) bootloader
Original NVD description (English source)
The image_verify function in platform/msm_shared/image_verify.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not check whether a certain digest size is consistent with the RSA_public_decrypt API specification, which makes it easier for attackers to bypass boot-image authentication requirements via trailing data.