Description
The Semtech LR11xx LoRa transceivers implement secure boot functionality using digital signatures to authenticate firmware. However, the implementation uses a non-standard cryptographic hashing algorithm that is vulnerable to second preimage attacks. An attacker with physical access to the device can exploit this weakness to generate a malicious firmware image with a hash collision, bypassing the secure boot verification mechanism and installing arbitrary unauthorized firmware on the device.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Semtech LR1110
Default version status: unaffected
0 to < BL2 FW 0x1001affected
Semtech LR1120
Default version status: unaffected
0 to < BL2 FW 0x2001affected
Semtech LR1121
Default version status: unaffected
0 to < BL2 FW 0x2101affected