CVE-2024-28183

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28183
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28183.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28183
Aliases
  • GHSA-22x6-3756-pfp8
Published
2024-03-25T14:31:28.466Z
Modified
2026-07-15T21:33:35.288178Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Anti Rollback bypass with physical access and TOCTOU attack
Details

ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass anti-rollback protection. Anti-rollback prevents rollback to application with security version lower than one programmed in eFuse of chip. This attack can allow to boot past (passive) application partition having lower security version of the same device even in the presence of the flash encryption scheme. The attack requires carefully modifying the flash contents after the anti-rollback checks have been performed by the bootloader (before loading the application). The vulnerability is fixed in 4.4.7 and 5.2.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28183.json",
    "cwe_ids": [
        "CWE-367"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/espressif/esp-idf

Affected ranges

Type
GIT
Repo
https://github.com/espressif/esp-idf
Events
Introduced
357290093430e41e7e3338227a61ef5162f2deed
Fixed
3305cb4d235182067936f8e940e6db174e25b4b2
Fixed
4c95aa445d4e84f01f86b6f3a552aa299276abf3
Fixed
534e3ad1fa68526a5f989fb2163856d6b7cd2c87
Fixed
7003f1ef0dffc73c34eb153d1b0710babb078149
Fixed
b2cdc0678965790f49afeb6e6b0737cd24433a05
Fixed
c33b9e1426121ce8cccf1a94241740be9cff68de
Fixed
f327ddf6adab0c28d395975785727b2feef57803
Database specific 
{
    "extracted_events": [
        {
            "introduced": "4.4.6"
        },
        {
            "last_affected": "4.4.6"
        },
        {
            "introduced": "5.0.6"
        },
        {
            "last_affected": "5.0.6"
        },
        {
            "introduced": "5.1.3"
        },
        {
            "last_affected": "5.1.3"
        },
        {
            "introduced": "5.2"
        },
        {
            "last_affected": "5.2"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:espressif:esp-idf:4.4.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.1.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:espressif:esp-idf:5.2:*:*:*:*:*:*:*"
    ]
}

Affected versions

4.*
4.4.6
5.*
5.0.6
5.1.3
5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28183.json"
vanir_signatures_modified 
"2026-07-15T21:33:35Z"
vanir_signatures 
[
    {
        "digest": {
            "function_hash": "40160987822930753280368981669739854279",
            "length": 1468.0
        },
        "id": "CVE-2024-28183-0c10387a",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2",
        "signature_type": "Function",
        "target": {
            "function": "process_segment_data",
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "297453641836049349369790522152269919588",
                "170184526550933012205292545324824026568",
                "167557401358855181246708734782158886055",
                "275271428803709352941690162741698678734"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28183-1bfc779f",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2",
        "signature_type": "Line",
        "target": {
            "file": "components/bootloader_support/include/esp_image_format.h"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "259233947953524173774241559275867025775",
                "87000213948492003119594966669959185158",
                "76546936749065761358364028538769613408",
                "297057986941155668537031850227852009147",
                "225527895053317381355762627920210354833",
                "79250725387900195448203477629145574989",
                "44463272292583692615192019278543163439",
                "139678846132557247558430680750855043297",
                "207459283931977096924852161442045802095",
                "253489886662271535698199603385752401328",
                "78925341563107802559101278546243629134",
                "55029462041876182765774423190151114189",
                "262287905057344196846966850526659727458",
                "174324744931803916814471796289698096785",
                "250688040966840899316424005713364275214",
                "291649013038131936082827124392939930155",
                "206314479153289219068102249176878601718",
                "10348885716936999004852569838768012635",
                "134972160455238025001717976363836895354",
                "213002194788169123737192472371070717066",
                "251429248483780214987168051481601101072",
                "118514508800294872562474800774953314153",
                "261410911622876896205017867276078829831",
                "144900985375844982691434262656165892320",
                "14745040097253497016462742390866182981",
                "22337696538323167752262649950463731917",
                "274151379962773793047464635412429798191",
                "295960474416440153143110700106097283627",
                "3798445583034722631364996167914831382",
                "181480122423840456371426876704336859684",
                "331887393394141777904030785886729600795",
                "186572598812274508572568202940961947522",
                "207241372994132634904348015949742264819"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28183-24d5e824",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2",
        "signature_type": "Line",
        "target": {
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "function_hash": "40160987822930753280368981669739854279",
            "length": 1468.0
        },
        "id": "CVE-2024-28183-2bc1d296",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Function",
        "target": {
            "function": "process_segment_data",
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "297453641836049349369790522152269919588",
                "170184526550933012205292545324824026568",
                "167557401358855181246708734782158886055",
                "275271428803709352941690162741698678734"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28183-44d6938c",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Line",
        "target": {
            "file": "components/bootloader_support/include/esp_image_format.h"
        }
    },
    {
        "digest": {
            "function_hash": "124772913179413909533012213784748582030",
            "length": 1745.0
        },
        "id": "CVE-2024-28183-507ce64e",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2",
        "signature_type": "Function",
        "target": {
            "function": "process_segment",
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "259233947953524173774241559275867025775",
                "87000213948492003119594966669959185158",
                "76546936749065761358364028538769613408",
                "297057986941155668537031850227852009147",
                "225527895053317381355762627920210354833",
                "79250725387900195448203477629145574989",
                "44463272292583692615192019278543163439",
                "139678846132557247558430680750855043297",
                "207459283931977096924852161442045802095",
                "253489886662271535698199603385752401328",
                "78925341563107802559101278546243629134",
                "55029462041876182765774423190151114189",
                "262287905057344196846966850526659727458",
                "174324744931803916814471796289698096785",
                "250688040966840899316424005713364275214",
                "291649013038131936082827124392939930155",
                "206314479153289219068102249176878601718",
                "10348885716936999004852569838768012635",
                "134972160455238025001717976363836895354",
                "213002194788169123737192472371070717066",
                "251429248483780214987168051481601101072",
                "118514508800294872562474800774953314153",
                "261410911622876896205017867276078829831",
                "144900985375844982691434262656165892320",
                "14745040097253497016462742390866182981",
                "22337696538323167752262649950463731917",
                "274151379962773793047464635412429798191",
                "295960474416440153143110700106097283627",
                "3798445583034722631364996167914831382",
                "181480122423840456371426876704336859684",
                "331887393394141777904030785886729600795",
                "186572598812274508572568202940961947522",
                "207241372994132634904348015949742264819"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28183-5621f78b",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Line",
        "target": {
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "function_hash": "166436537970057644646793088100403142231",
            "length": 888.0
        },
        "id": "CVE-2024-28183-5db79e46",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Function",
        "target": {
            "function": "process_segments",
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "250595648297568405908834386061291167915",
                "65560690932845903491934138748929979353",
                "59282903876203335863686957927856187900"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28183-5e9f8abb",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Line",
        "target": {
            "file": "components/esp_system/startup.c"
        }
    },
    {
        "digest": {
            "function_hash": "166436537970057644646793088100403142231",
            "length": 888.0
        },
        "id": "CVE-2024-28183-87dffc04",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2",
        "signature_type": "Function",
        "target": {
            "function": "process_segments",
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "function_hash": "199352727806339371523761471047717806174",
            "length": 2678.0
        },
        "id": "CVE-2024-28183-91c224e3",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Function",
        "target": {
            "function": "do_core_init",
            "file": "components/esp_system/startup.c"
        }
    },
    {
        "digest": {
            "function_hash": "124772913179413909533012213784748582030",
            "length": 1745.0
        },
        "id": "CVE-2024-28183-95510736",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Function",
        "target": {
            "function": "process_segment",
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "function_hash": "135601338421104256421334569682776410255",
            "length": 3223.0
        },
        "id": "CVE-2024-28183-9869edf0",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Function",
        "target": {
            "function": "image_load",
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "24350146381942182493598606081317886323",
                "114952153504146937097005532696891130879",
                "79845414628205574644052256357869981593",
                "147822309632785128811956386847273847214"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28183-d088df72",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2",
        "signature_type": "Line",
        "target": {
            "file": "components/esp_app_format/include/esp_app_desc.h"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "24350146381942182493598606081317886323",
                "114952153504146937097005532696891130879",
                "79845414628205574644052256357869981593",
                "147822309632785128811956386847273847214"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28183-d19ba0b0",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3",
        "signature_type": "Line",
        "target": {
            "file": "components/esp_app_format/include/esp_app_desc.h"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "270280173998896549603443079641446642331",
                "109904899741061028427712151075714454283",
                "36691302750872916068295473665374205438",
                "39678504277814403235286287089275658308"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-28183-ea2b3e6d",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2",
        "signature_type": "Line",
        "target": {
            "file": "components/esp_system/startup_funcs.c"
        }
    },
    {
        "digest": {
            "function_hash": "135601338421104256421334569682776410255",
            "length": 3223.0
        },
        "id": "CVE-2024-28183-eeb23f9c",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2",
        "signature_type": "Function",
        "target": {
            "function": "image_load",
            "file": "components/bootloader_support/src/esp_image_format.c"
        }
    }
]