CVE-2024-13942 is a TOCTOU race condition in the Secure BootROM of Rockchip RK3588s SoC. The boot process reads the next-stage loader header twice: initially partially to obtain hashes of executable modules, and then fully to verify the header signature. The executable modules are authenticated against the partial read, creating a window for an attacker with physical access to modify the loader data on-the-fly using low-cost hardware emulators for SPI NOR/NAND, EMMC, or SD media. This manipulation can bypass signature verification and lead to arbitrary code execution at EL3 privilege. The vulnerability affects RK3588s BootROM version 350B20210512V100 and possibly others. No official fix or patch is currently documented; mitigation requires following vendor instructions or discontinuing use if no mitigation is available.

An attacker with physical access to a device containing the vulnerable RK3588s SoC can exploit this TOCTOU race condition to execute arbitrary code with the highest privilege level (EL3). This compromises the secure boot process, potentially allowing full control over the device firmware and undermining device security and trust. The vulnerability affects devices booting from external media such as SPI NOR/NAND, EMMC, or SD cards.

No official patch or fix is currently documented by the vendor. Users should apply any mitigations provided by Rockchip per their instructions. If no mitigations are available, discontinuing use of the affected product is recommended. Physical security controls to prevent attacker access to the device's external boot media may reduce risk. Monitor the vendor advisory at https://www.rock-chips.com/a/en/products/RK35_Series/2022/0926/1660.html for updates on remediation.