Description
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the file is reopened for installation. An attacker who can modify the update file just before it is reopened can install arbitrary code on the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Pengutronix RAUC | All versions before 1.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rauc | 1.5-1 | — |
| Debian 13 | rauc | 1.5-1 | — |
| Debian 12 | rauc | 1.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | rauc | No fix yet | — |
| Ubuntu 20.04 LTS | rauc | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
rauc/rauc-1.5-integration ★ 1 · Nov 30, 2020
integration examples for the CVE-2020-25860 fix
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.