CVE-2026-50719: заобикаляне на вход и права

Описание

Оригинално описание

The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. The init table parser supports full-address 32-bit write operations, allowing modification of SRAM-resident secure boot state prior to the verification decision. An attacker with physical write access to boot media can inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or modified first-stage boot code. This has been hardware-validated on a secureboot-enabled T41 device; ROM analysis confirms closely related behavior on T32, T40, and A1.

Засегнати продукти

• n/a n/a: n/a

Вид слабост

• CWE-474 Използване на функция с несъвместими реализации
• CWE-347 Неправилна проверка на криптографски подпис
• CWE-284 Неправилен контрол на достъпа

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-50719
• https://nvd.nist.gov/vuln/detail/CVE-2026-50719
• https://opensensor.io/security/ingenic-t32-t40-t41-a1-init-table-bypass