The Ingenic T31 SoC boot ROM flash-boot verification path compares only a single 32-bit word of the RSA signature output against a single 32-bit word of the SHA-256 payload digest, rather than compare the full data. This allows an attacker with physical write access to boot media to forge modified SPL (Secondary Program Loader) images that pass secure boot verification without possession of the OEM signin [truncated]
The Ingenic T41, and probably also T32, T40, and A1 SoC boot ROMs, parse and execute an attacker-controlled init table from the SPL header before checking the secure boot state and before invoking signature verification. This vulnerability allows an attacker with physical write access to boot media to inject an init-table entry that disables the secure boot check, causing the ROM to accept unsigned or mod [truncated]
