# CVE-2019-13104: Das U-Boot integer underflow in ext4 filesystem parsing

Source: https://junglewise.ai/threats/cve-2019-13104-das-u-boot-integer-underflow-in-ext4-filesystem-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-08-06. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2019-13104 · Severity: high · CVSS 7.8 · Published 2019-08-06

A vulnerability exists in the U-Boot bootloader, which is commonly used in embedded systems and network hardware. By providing a specially crafted storage device (like a USB drive or SD card) with a malicious filesystem, an attacker could cause the system to crash or potentially take control of the device during the boot process. This could lead to a complete compromise of the device's security and data.

Technologies: [Siemens ROX II](https://junglewise.ai/threats/technologies/rox-ii). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2019-13104 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-13104 being exploited in the wild.

**How severe is CVE-2019-13104?** High severity, with a CVSS score of 7.8, published 6 August 2019.

**Which products and versions are affected?** Siemens ROX II versions before 2.17.1.

**Is there a fix for CVE-2019-13104?** A patch was published on 2019-07-08: Patch submitted to U-Boot mailing list Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-13104 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2019-13104?** Check whether you run Siemens ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer underflow vulnerability exists in the ext4fs_read_file function within fs/ext4/ext4fs.c of Das U-Boot. When processing a crafted ext4 filesystem, the 'len' variable can underflow, leading to a memcpy() operation with an extremely large (effectively infinite) length. This results in an out-of-bounds write that can overwrite the entire stack and other memory regions. An attacker with the ability to provide a malicious filesystem to the bootloader can achieve arbitrary code execution or a denial-of-service state. The issue is fixed by adding checks for negative length and blocksize values.

## Affected products

- Das U-Boot U-Boot 2016.11-rc1 through 2019.07-rc4
- Siemens Ruggedcom ROX II family versions before 2.17.1

## Timeline

- 2019-07-08: patched: Patch submitted to U-Boot mailing list
- 2019-08-06: disclosed: NVD publication date
- 2026-05-12: advisory: Siemens published advisory for Ruggedcom ROX products

## References

- [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00002.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00002.html)
- [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00004.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00004.html)
- [https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75](https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75)
- [https://github.com/u-boot/u-boot/commits/master](https://github.com/u-boot/u-boot/commits/master)
- [https://lists.denx.de/pipermail/u-boot/2019-July/375514.html](https://lists.denx.de/pipermail/u-boot/2019-July/375514.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-577017.html](https://cert-portal.siemens.com/productcert/html/ssa-577017.html)

## Related threats

- [GNOME libxml2 stack overflow in XPath evaluation](https://junglewise.ai/threats/cve-2025-9714-gnome-libxml2-stack-overflow-in-xpath-evaluation)
- [QEMU heap buffer overflow in SDHCI device emulation](https://junglewise.ai/threats/cve-2024-3447-qemu-heap-buffer-overflow-in-sdhci-device-emulation)
- [Denx Das U-Boot stack buffer overflow in i2c md command](https://junglewise.ai/threats/cve-2022-34835-denx-das-u-boot-stack-buffer-overflow-in-i2c-md-command)
- [Das U-Boot stack overflow in nfs_mount_reply](https://junglewise.ai/threats/cve-2019-14203-das-u-boot-stack-overflow-in-nfs-mount-reply)
- [Das U-Boot stack overflow in nfs_readlink_reply](https://junglewise.ai/threats/cve-2019-14202-das-u-boot-stack-overflow-in-nfs-readlink-reply)