Poisoned Pipeline / Incidents / AS287
fwupd dangling S3 bucket and CVE-2020-10759 signature-verification bypass
Linux distro / packagesInstaller / update channel
Justin Steven’s April 2020 advisory covered two related fwupd findings:
an abandoned Amazon S3 bucket that fwupd metadata could be redirected
to (a dangling- infrastructure takeover opportunity), and
CVE-2020-10759, a bypass of fwupd’s PGP signature verification that let
a malicious metadata file make unsigned firmware look authentic. Both
are researcher bug discovery: the bucket was never used to ship malware
to fwupd users, and the bypass had no documented victims. Included as
research, not a real-world incident — it demonstrates that update
infrastructure and artifact verification are attacker targets
(T0209/T0207 class), but no in-the-wild exploitation is known.
Mapped techniques
supply-chain researcher findings
Dangling S3 bucket as a metadata-redirect opportunity (not exploited).
CVE-2020-10759 PGP verification bypass PoC.