Executive brief
A vulnerability exists in the U-Boot bootloader, which is commonly used in embedded systems and network hardware. By providing a specially crafted storage device (like a USB drive or SD card) with a malicious filesystem, an attacker could cause the system to crash or potentially take control of the device during the boot process. This could lead to a complete compromise of the device's security and data.
Technical details
An integer underflow vulnerability exists in the ext4fs_read_file function within fs/ext4/ext4fs.c of Das U-Boot. When processing a crafted ext4 filesystem, the 'len' variable can underflow, leading to a memcpy() operation with an extremely large (effectively infinite) length. This results in an out-of-bounds write that can overwrite the entire stack and other memory regions. An attacker with the ability to provide a malicious filesystem to the bootloader can achieve arbitrary code execution or a denial-of-service state. The issue is fixed by adding checks for negative length and blocksize values.
Affected products
- Das U-Boot U-Boot 2016.11-rc1 through 2019.07-rc4
- Siemens Ruggedcom ROX II family versions before 2.17.1
Timeline
- 2019-07-08: patched: Patch submitted to U-Boot mailing list
- 2019-08-06: disclosed: NVD publication date
- 2026-05-12: advisory: Siemens published advisory for Ruggedcom ROX products
References
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00004.html
- https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75
- https://github.com/u-boot/u-boot/commits/master
- https://lists.denx.de/pipermail/u-boot/2019-July/375514.html
- https://cert-portal.siemens.com/productcert/html/ssa-577017.html