Junglewise Threat Intelligence

CVE-2019-13106: Denx U-Boot stack buffer overflow in ext4fs_read_file

CVE-2019-13106 · Severity: high · CVSS 7.8 · Published 2019-08-06

Technologies: Denx U-Boot, Siemens RUGGEDCOM ROX II. Vendors: Siemens, Denx.

Executive brief

U-Boot, a widely used bootloader for embedded devices, contains a vulnerability that can be triggered when reading a specially crafted storage drive. An attacker who can provide a malicious filesystem (for example, via a USB drive or SD card) could potentially take full control of the device's startup process. This could allow them to bypass security features like verified boot, leading to unauthorized access or permanent device compromise.

Technical details

A stack-based buffer overflow exists in the ext4fs_read_file function within ext4fs.c of Das U-Boot. The vulnerability is caused by an improper bounds check during a memset() operation when a filename or other filesystem structure spans across a block boundary. An attacker can exploit this by providing a crafted ext4 filesystem image; when U-Boot attempts to list or read files from this filesystem, it may overwrite the stack with zeros. The number of zeros written is controllable by the attacker, potentially allowing for arbitrary code execution and the defeat of verified boot mechanisms. The issue was patched in the U-Boot master branch in July 2019.

Affected products

  • Denx U-Boot 2016.09 through 2019.07-rc4
  • Siemens Ruggedcom Rox II family Before 2.17.1

Timeline

  • 2019-07-08: patched: Patch submitted to U-Boot mailing list
  • 2019-08-06: disclosed: Initial NVD publication
  • 2026-05-12: advisory: Siemens advisory SSA-577017 published for Ruggedcom Rox II family

References

Related threats