CVE-2014-4325

High

Published: 25/08/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

The cmd_boot function in the Little Kernel (LK) bootloader allows attackers to bypass device-lock and kernel-signature restrictions by using fastboot mode to boot an arbitrary kernel image.

Risk Assessment

Attackers may gain unauthorized access to the device, potentially leading to system takeover and data leakage.

Recommendation

It is recommended to update the bootloader to the latest version and implement additional security measures to protect against unauthorized access.

Other vulnerabilities in Little Kernel (LK) bootloader

CVE-2014-0973High
The image_verify function in the Little Kernel (LK) bootloader does not check whether a certain digest size is consistent with the RSA_public_decrypt API specification, allowing attackers to bypass boot-image authentication requirements via trailing data.

Original NVD description (English source)

The cmd_boot function in app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to bypass intended device-lock and kernel-signature restrictions by using fastboot mode in a boot command for an arbitrary kernel image.