{"id":"DEBIAN-CVE-2017-3226","details":"Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC encryption feature using environment encryption (i.e., setting the configuration parameter CONFIG_ENV_AES=y) read environment variables from disk as the encrypted disk image is processed. An attacker with physical access to the device can manipulate the encrypted environment data to include a crafted two-byte sequence which triggers an error in environment variable parsing. This error condition is improperly handled by Das U-Boot, resulting in an immediate process termination with a debugging message.","modified":"2026-09-01T20:03:47.940841802Z","published":"2018-07-24T15:29:00.983Z","upstream":["CVE-2017-3226"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2017-3226"}],"affected":[{"package":{"name":"u-boot","ecosystem":"Debian:12","purl":"pkg:deb/debian/u-boot?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.01+dfsg-2","2023.01+dfsg-2+deb12u1","2023.01+dfsg-2+deb12u2","2023.01+dfsg-2+deb12u3","2023.04+dfsg-1","2023.04~rc2+dfsg-1","2023.04~rc5+dfsg-1","2023.07+dfsg-1","2023.07~rc4+dfsg-1","2023.07~rc5+dfsg-1","2024.01+dfsg-1","2024.01+dfsg-2","2024.01+dfsg-3","2024.01+dfsg-4","2024.01+dfsg-5","2024.01+dfsg-6","2024.01+dfsg-7","2024.01~rc6+dfsg-1","2024.01~rc6+dfsg-2","2025.01-1","2025.01-2","2025.01-3","2025.01-3.1","2025.01-3.2"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-3226.json"}},{"package":{"name":"u-boot","ecosystem":"Debian:13","purl":"pkg:deb/debian/u-boot?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.01-3","2025.01-3+deb13u1","2025.01-3.1","2025.01-3.2"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-3226.json"}},{"package":{"name":"u-boot","ecosystem":"Debian:14","purl":"pkg:deb/debian/u-boot?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.01-3","2025.01-3.1","2025.01-3.2"],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2017-3226.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}