Executive brief
U-Boot is a widely used bootloader for embedded devices that initializes hardware and loads the operating system. A vulnerability in how it handles certain filesystem data could allow an attacker with physical access to bypass security protections like Verified Boot. This could lead to unauthorized code execution, potentially compromising the device's integrity and any sensitive data it handles.
Technical details
An integer overflow exists in the ext4fs_read_symlink() function within Das U-Boot. The vulnerability occurs when the code adds one to an le32 variable representing the inode size during a zalloc() call. By providing a crafted ext4 filesystem with an inode size of 0xffffffff, the addition overflows to zero, leading to a zero-byte allocation. Subsequent data copying using the original large inode size results in a heap-based memory overwrite. This can be exploited by an attacker with physical access to the device (e.g., via a malicious USB drive or SD card) to bypass Verified Boot and achieve arbitrary code execution. The issue is fixed in U-Boot version 2025.01-rc1 and Siemens Ruggedcom Rox 2.17.1.
Affected products
- Das U-Boot U-Boot before 2025.01-rc1
- Siemens Ruggedcom Rox II family before 2.17.1
Timeline
- 2024-08-09: other: Patch authored
- 2025-02-17: disclosed: Public disclosure via Openwall mailing list
- 2025-02-18: advisory: NVD publication date
- 2026-05-12: patched: Siemens advisory published for Ruggedcom Rox products