Threats tagged 'ghsa-wwg9-9xxp-r5fj'

A low-severity vulnerability in MCUBOOT's boot_save_boot_status() function can cause uninitialized stack memory to be included in the measured-boot record when the EXPECTED_HASH_TLV length is shorter than expected. This occurs only if primary-slot validation is disabled, allowing an attacker with physical or flash-write access to embed stale stack data in the attestation measurement. The issue does not affect integrity or availability and is considered a defense-in-depth information disclosure.