Loading vulnerability…
AVB Verification Bypass in U-Boot on Google Chromecast
CVE-2023-48425 is a U-Boot secure-boot enforcement flaw affecting Google Chromecast devices using an Amlogic SoC. When the U-Boot environment variable upgrade_step is set to 3, the boot logic overwrites the result returned by Android Verified Boot (AVB) verification with a successful result. Consequently, an AVB verification failure does not terminate the boot process as intended.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to trigger the vulnerable boot path can bypass AVB failure enforcement, causing U-Boot to treat a failed AVB verification result as valid. This can enable execution of unauthorized code during boot; the vulnerability is described as resulting in persistent code execution when used in an applicable exploitation chain.
If you can’t patch tonight, do this now.
Until patched firmware is deployed, reduce opportunities for attackers to manipulate the boot process or bootloader state. Prevent physical access to the device and exposed debug interfaces, and restrict any ability to alter bootloader environment or interrupt boot. Where operationally possible, monitor device integrity and reflash affected devices with trusted firmware if compromise is suspected. Mitigation is limited because the flaw exists in early boot enforcement logic.
Patch, then assume compromise.
Update affected Chromecast firmware to a version containing the vendor fix for the U-Boot logic flaw. The remediation must ensure that AVB verification results from avb_slot_verify() are not overwritten or ignored and that any verification failure terminates the boot path. Review related bootloader logic for fail-open behavior around upgrade and recovery state handling.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.