{"id":"CVE-2024-28183","summary":"Anti Rollback bypass with physical access and TOCTOU attack","details":"ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass anti-rollback protection. Anti-rollback prevents rollback to application with security version lower than one programmed in eFuse of chip. This attack can allow to boot past (passive) application partition having lower security version of the same device even in the presence of the flash encryption scheme. The attack requires carefully modifying the flash contents after the anti-rollback checks have been performed by the bootloader (before loading the application). The vulnerability is fixed in 4.4.7 and 5.2.1.","aliases":["GHSA-22x6-3756-pfp8"],"modified":"2026-08-12T14:52:06.819977Z","published":"2024-03-25T14:31:28.466Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-367"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28183.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28183.json"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-22x6-3756-pfp8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28183"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/534e3ad1fa68526a5f989fb2163856d6b7cd2c87"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/7003f1ef0dffc73c34eb153d1b0710babb078149"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/b2cdc0678965790f49afeb6e6b0737cd24433a05"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/c33b9e1426121ce8cccf1a94241740be9cff68de"},{"type":"FIX","url":"https://github.com/espressif/esp-idf/commit/f327ddf6adab0c28d395975785727b2feef57803"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"357290093430e41e7e3338227a61ef5162f2deed"},{"fixed":"3305cb4d235182067936f8e940e6db174e25b4b2"},{"fixed":"4c95aa445d4e84f01f86b6f3a552aa299276abf3"},{"fixed":"534e3ad1fa68526a5f989fb2163856d6b7cd2c87"},{"fixed":"7003f1ef0dffc73c34eb153d1b0710babb078149"},{"fixed":"b2cdc0678965790f49afeb6e6b0737cd24433a05"},{"fixed":"c33b9e1426121ce8cccf1a94241740be9cff68de"},{"fixed":"f327ddf6adab0c28d395975785727b2feef57803"}],"database_specific":{"extracted_events":[{"introduced":"4.4.6"},{"last_affected":"4.4.6"},{"introduced":"5.0.6"},{"last_affected":"5.0.6"},{"introduced":"5.1.3"},{"last_affected":"5.1.3"},{"introduced":"5.2"},{"last_affected":"5.2"}],"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:espressif:esp-idf:4.4.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.0.6:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.1.3:*:*:*:*:*:*:*","cpe:2.3:a:espressif:esp-idf:5.2:*:*:*:*:*:*:*"]}}],"versions":["4.4.6","5.0.6","5.1.3","5.2"],"database_specific":{"vanir_signatures":[{"digest":{"function_hash":"40160987822930753280368981669739854279","length":1468},"id":"CVE-2024-28183-0c10387a","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2","target":{"file":"components/bootloader_support/src/esp_image_format.c","function":"process_segment_data"},"deprecated":false},{"digest":{"line_hashes":["297453641836049349369790522152269919588","170184526550933012205292545324824026568","167557401358855181246708734782158886055","275271428803709352941690162741698678734"],"threshold":0.9},"id":"CVE-2024-28183-1bfc779f","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2","target":{"file":"components/bootloader_support/include/esp_image_format.h"},"deprecated":false},{"target":{"file":"components/bootloader_support/src/esp_image_format.c"},"deprecated":false,"digest":{"line_hashes":["259233947953524173774241559275867025775","87000213948492003119594966669959185158","76546936749065761358364028538769613408","297057986941155668537031850227852009147","225527895053317381355762627920210354833","79250725387900195448203477629145574989","44463272292583692615192019278543163439","139678846132557247558430680750855043297","207459283931977096924852161442045802095","253489886662271535698199603385752401328","78925341563107802559101278546243629134","55029462041876182765774423190151114189","262287905057344196846966850526659727458","174324744931803916814471796289698096785","250688040966840899316424005713364275214","291649013038131936082827124392939930155","206314479153289219068102249176878601718","10348885716936999004852569838768012635","134972160455238025001717976363836895354","213002194788169123737192472371070717066","251429248483780214987168051481601101072","118514508800294872562474800774953314153","261410911622876896205017867276078829831","144900985375844982691434262656165892320","14745040097253497016462742390866182981","22337696538323167752262649950463731917","274151379962773793047464635412429798191","295960474416440153143110700106097283627","3798445583034722631364996167914831382","181480122423840456371426876704336859684","331887393394141777904030785886729600795","186572598812274508572568202940961947522","207241372994132634904348015949742264819"],"threshold":0.9},"id":"CVE-2024-28183-24d5e824","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2"},{"source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"file":"components/bootloader_support/src/esp_image_format.c","function":"process_segment_data"},"deprecated":false,"digest":{"function_hash":"40160987822930753280368981669739854279","length":1468},"id":"CVE-2024-28183-2bc1d296","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2024-28183-44d6938c","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"file":"components/bootloader_support/include/esp_image_format.h"},"deprecated":false,"digest":{"line_hashes":["297453641836049349369790522152269919588","170184526550933012205292545324824026568","167557401358855181246708734782158886055","275271428803709352941690162741698678734"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2","target":{"function":"process_segment","file":"components/bootloader_support/src/esp_image_format.c"},"deprecated":false,"digest":{"length":1745,"function_hash":"124772913179413909533012213784748582030"},"id":"CVE-2024-28183-507ce64e"},{"digest":{"line_hashes":["259233947953524173774241559275867025775","87000213948492003119594966669959185158","76546936749065761358364028538769613408","297057986941155668537031850227852009147","225527895053317381355762627920210354833","79250725387900195448203477629145574989","44463272292583692615192019278543163439","139678846132557247558430680750855043297","207459283931977096924852161442045802095","253489886662271535698199603385752401328","78925341563107802559101278546243629134","55029462041876182765774423190151114189","262287905057344196846966850526659727458","174324744931803916814471796289698096785","250688040966840899316424005713364275214","291649013038131936082827124392939930155","206314479153289219068102249176878601718","10348885716936999004852569838768012635","134972160455238025001717976363836895354","213002194788169123737192472371070717066","251429248483780214987168051481601101072","118514508800294872562474800774953314153","261410911622876896205017867276078829831","144900985375844982691434262656165892320","14745040097253497016462742390866182981","22337696538323167752262649950463731917","274151379962773793047464635412429798191","295960474416440153143110700106097283627","3798445583034722631364996167914831382","181480122423840456371426876704336859684","331887393394141777904030785886729600795","186572598812274508572568202940961947522","207241372994132634904348015949742264819"],"threshold":0.9},"id":"CVE-2024-28183-5621f78b","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"file":"components/bootloader_support/src/esp_image_format.c"},"deprecated":false},{"id":"CVE-2024-28183-5db79e46","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"function":"process_segments","file":"components/bootloader_support/src/esp_image_format.c"},"deprecated":false,"digest":{"function_hash":"166436537970057644646793088100403142231","length":888}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"file":"components/esp_system/startup.c"},"deprecated":false,"digest":{"line_hashes":["250595648297568405908834386061291167915","65560690932845903491934138748929979353","59282903876203335863686957927856187900"],"threshold":0.9},"id":"CVE-2024-28183-5e9f8abb"},{"digest":{"function_hash":"166436537970057644646793088100403142231","length":888},"id":"CVE-2024-28183-87dffc04","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2","target":{"file":"components/bootloader_support/src/esp_image_format.c","function":"process_segments"},"deprecated":false},{"deprecated":false,"digest":{"length":2678,"function_hash":"199352727806339371523761471047717806174"},"id":"CVE-2024-28183-91c224e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"file":"components/esp_system/startup.c","function":"do_core_init"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"file":"components/bootloader_support/src/esp_image_format.c","function":"process_segment"},"deprecated":false,"digest":{"function_hash":"124772913179413909533012213784748582030","length":1745},"id":"CVE-2024-28183-95510736","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"135601338421104256421334569682776410255","length":3223},"id":"CVE-2024-28183-9869edf0","signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"file":"components/bootloader_support/src/esp_image_format.c","function":"image_load"}},{"deprecated":false,"digest":{"line_hashes":["24350146381942182493598606081317886323","114952153504146937097005532696891130879","79845414628205574644052256357869981593","147822309632785128811956386847273847214"],"threshold":0.9},"id":"CVE-2024-28183-d088df72","signature_type":"Line","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2","target":{"file":"components/esp_app_format/include/esp_app_desc.h"}},{"signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3","target":{"file":"components/esp_app_format/include/esp_app_desc.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["24350146381942182493598606081317886323","114952153504146937097005532696891130879","79845414628205574644052256357869981593","147822309632785128811956386847273847214"]},"id":"CVE-2024-28183-d19ba0b0","signature_type":"Line"},{"source":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2","target":{"file":"components/esp_system/startup_funcs.c"},"deprecated":false,"digest":{"line_hashes":["270280173998896549603443079641446642331","109904899741061028427712151075714454283","36691302750872916068295473665374205438","39678504277814403235286287089275658308"],"threshold":0.9},"id":"CVE-2024-28183-ea2b3e6d","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2","target":{"file":"components/bootloader_support/src/esp_image_format.c","function":"image_load"},"deprecated":false,"digest":{"length":3223,"function_hash":"135601338421104256421334569682776410255"},"id":"CVE-2024-28183-eeb23f9c"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28183.json","vanir_signatures_modified":"2026-08-12T14:52:06Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}