CVE-2020-11684: LINUX4SAM AT91BOOTSTRAP

Critical severity, CVSS 9.1. EPSS: 1.1% chance of exploitation in the next 30 days.

AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).

Affected products

• LINUX4SAM AT91BOOTSTRAP: from 3.7.2, before 3.9.2 (fixed in 3.9.2)

Published 2020-09-14. Last modified 2026-06-17.