CVE-2021-27097: 
Linux Debian vulnerability analysis and mitigation

The vulnerability CVE-2021-27097 affects the boot loader in Das U-Boot versions before 2021.04-rc2. The vulnerability was discovered and disclosed in February 2021, specifically related to how U-Boot mishandles a modified FIT (Flattened Image Tree) (CVE Details).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue specifically involves how the boot loader handles modified FIT images, which could potentially lead to security risks when processing these images (NVD).

The vulnerability could potentially lead to high impacts on confidentiality, integrity, and availability of the system. When exploited, it could allow an attacker to compromise the security of the boot process through carefully crafted FIT images (Ubuntu Security).

The vulnerability requires local access and user interaction to exploit. The attack complexity is considered low, and no privileges are required to execute the attack, making it relatively straightforward to exploit under the right conditions (NVD).

The vulnerability was fixed in U-Boot version 2021.04-rc2 and later. The fix includes adding an option to perform a full check of the FIT to ensure its validity, including checks for bad structure and multiple root nodes. This feature is enabled by default when signature verification is enabled (U-Boot Commit).