CVE-2024-28183 – Anti Rollback bypass with physical access and TOCTOU attack

https://notcve.org/view.php?id=CVE-2024-28183

25 Mar 2024 — ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass anti-rollback protection. Anti-rollback prevents rollback to application with security version lower than one programmed in eFuse of chip. This attack can allow to boot past (passive) application partition having low... • https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •