Vulnerability Note VU#400865
Original Release Date: 2019-05-14 | Last Revised: 2019-05-14
Overview
Cisco’s Trust Anchor module (TAm) can be bypassed through manipulating the bitstream of the Field Programmable Gate Array (FPGA). This component handles access control to a hardware component within Cisco’s Secure Boot implementations, which affects multiple products that support this functionality. An authenticated, local attacker could write a new firmware image to the TAm. Additionally, Cisco’s IOS XE web UI improperly sanitizes user-input, and could allow an authenticated, remote attack to execute commands. An authenticated, remote attacker could execute commands as root on the vulnerable device.
Description
| CVE-2019-1649: Secure Boot Tampering, also known as Thrangrycat
The logic that handles the access controls to TAm within Cisco’s Secure Boot improperly checks an area of code that manages the Field Programmable Gate Array (FPGA). The TAm is a proprietary hardware chip used for many security services within Cisco products, including nonvolatile secure storage, cryptography services, and as a Secure Unit Device Identifier. The TAm can be bypassed by modifying the bitstream of the FPGA, allowing an authenticated, local attacker to make persistent modification to the TAm. CVE-2019-1862: IOS XE Web UI Command Injection |
Impact
| A local or remote attacker could write a new firmware image to the TAm. When exploited together, these vulnerabilities could allow a remote, authenticated attacker to remotely and persistently bypass Secure Boot and prevent future software updates to the TAm.
To exploit CVE-2019-1649, an attacker would need to have privileged administrative access to the device. This type of access could be achieved by exploiting the vulnerability described in CVE-2019-1862 or other potential remote command injection vulnerabilities. |
Solution
| CVE-2019-1649 Cisco is in the process of developing and releasing software fixes for all affected platforms. We recommend installing this update when it is available.CVE-2019-1862 Apply the update from Cisco. |
| CVE-2019-1649 Guidance from Cisco recommends that users refer to the Cisco Guide to Harden Cisco IOS Devices, as it provides information about how to harden the device and secure management access. Implementing the recommendations in this document would likely reduce the attack surface for this vulnerability. |
