# CVE-2019-13106: Denx U-Boot stack buffer overflow in ext4fs_read_file

Source: https://junglewise.ai/threats/cve-2019-13106-denx-u-boot-stack-buffer-overflow-in-ext4fs-read-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-08-06. Updated: 2026-05-12  
License: CC BY 4.0 with a link back

CVE-2019-13106 · Severity: high · CVSS 7.8 · Published 2019-08-06

U-Boot, a widely used bootloader for embedded devices, contains a vulnerability that can be triggered when reading a specially crafted storage drive. An attacker who can provide a malicious filesystem (for example, via a USB drive or SD card) could potentially take full control of the device's startup process. This could allow them to bypass security features like verified boot, leading to unauthorized access or permanent device compromise.

Technologies: [Siemens RUGGEDCOM ROX II](https://junglewise.ai/threats/technologies/ruggedcom-rox-ii). Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2019-13106 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-13106 being exploited in the wild.

**How severe is CVE-2019-13106?** High severity, with a CVSS score of 7.8, published 6 August 2019.

**Which products and versions are affected?** Siemens RUGGEDCOM ROX II Before 2.17.1.

**Is there a fix for CVE-2019-13106?** A patch was published on 2019-07-08: Patch submitted to U-Boot mailing list Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-13106 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2019-13106?** Check whether you run Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow exists in the ext4fs_read_file function within ext4fs.c of Das U-Boot. The vulnerability is caused by an improper bounds check during a memset() operation when a filename or other filesystem structure spans across a block boundary. An attacker can exploit this by providing a crafted ext4 filesystem image; when U-Boot attempts to list or read files from this filesystem, it may overwrite the stack with zeros. The number of zeros written is controllable by the attacker, potentially allowing for arbitrary code execution and the defeat of verified boot mechanisms. The issue was patched in the U-Boot master branch in July 2019.

## Affected products

- Denx U-Boot 2016.09 through 2019.07-rc4
- Siemens Ruggedcom Rox II family Before 2.17.1

## Timeline

- 2019-07-08: patched: Patch submitted to U-Boot mailing list
- 2019-08-06: disclosed: Initial NVD publication
- 2026-05-12: advisory: Siemens advisory SSA-577017 published for Ruggedcom Rox II family

## References

- [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00002.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00002.html)
- [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00004.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00004.html)
- [https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75](https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75)
- [https://github.com/u-boot/u-boot/commits/master](https://github.com/u-boot/u-boot/commits/master)
- [https://lists.denx.de/pipermail/u-boot/2019-July/375516.html](https://lists.denx.de/pipermail/u-boot/2019-July/375516.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-577017.html](https://cert-portal.siemens.com/productcert/html/ssa-577017.html)

## Related threats

- [A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All…](https://junglewise.ai/threats/cve-2024-56840-a-vulnerability-has-been-identified-in-ruggedcom-rox-mx5000-all)
- [A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All…](https://junglewise.ai/threats/cve-2024-56839-a-vulnerability-has-been-identified-in-ruggedcom-rox-mx5000-all)
- [A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All…](https://junglewise.ai/threats/cve-2024-56838-a-vulnerability-has-been-identified-in-ruggedcom-rox-mx5000-all)
- [A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All…](https://junglewise.ai/threats/cve-2024-56837-a-vulnerability-has-been-identified-in-ruggedcom-rox-mx5000-all)
- [A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All…](https://junglewise.ai/threats/cve-2024-56836-a-vulnerability-has-been-identified-in-ruggedcom-rox-mx5000-all)