Every CVE Search/ Get API key

CVE-2017-3225

Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data

4.6 Medium

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.31%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 4.6

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.

Record
CVE-2017-3225
CVSS 3.0
4.6 MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-329, CWE-310
Updated
2026-11-02
CVE List No score

Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector that may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.

Record
CVE-2017-3225
Weakness
CWE-329
Updated
2026-11-02
EUVDEUVD-2017-12346 No score

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.

Record
EUVD-2017-12346
Updated
2026-11-03
GitHub AdvisoriesGHSA-x8ww-88gq-789c 4.6

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For...

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.

Record
GHSA-x8ww-88gq-789c
CVSS 3.0
4.6 MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSV 4.6

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.

Record
CVE-2017-3225
CVSS 3.0
4.6 MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-3225 4.6

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses a zero (0) initialization vector. This allows an attacker to perform dictionary attacks on encrypted data produced by Das U-Boot to learn information about the encrypted data.

Record
DEBIAN-CVE-2017-3225
CVSS 3.0
4.6 MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
u-boot
Debian:12
All versions, plus listed versions
2023.01+dfsg-22023.01+dfsg-2+deb12u12023.01+dfsg-2+deb12u22023.01+dfsg-2+deb12u32023.04+dfsg-1
Show 19 moreShow less
2023.04~rc2+dfsg-12023.04~rc5+dfsg-12023.07+dfsg-12023.07~rc4+dfsg-12023.07~rc5+dfsg-12024.01+dfsg-12024.01+dfsg-22024.01+dfsg-32024.01+dfsg-42024.01+dfsg-52024.01+dfsg-62024.01+dfsg-72024.01~rc6+dfsg-12024.01~rc6+dfsg-22025.01-12025.01-22025.01-32025.01-3.12025.01-3.2
None known
u-boot
Debian:13
All versions, plus listed versions
2025.01-32025.01-3+deb13u12025.01-3.12025.01-3.2
None known
u-boot
Debian:14
All versions, plus listed versions
2025.01-32025.01-3.12025.01-3.2
None known

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-3225 is a medium vulnerability (CVSS 4.6) in Das U-boot, published July 24, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 23rd percentile. No source names a fixed version.

References

MoveEnter Open