Is CVE-2024-57256 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-57256 being exploited in the wild.

How severe is CVE-2024-57256?

High severity, with a CVSS score of 7.1, published 18 February 2025.

Which products and versions are affected?

Siemens RUGGEDCOM ROX II before 2.17.1.

Is there a fix for CVE-2024-57256?

A patch was published on 2026-05-12: Siemens advisory published for Ruggedcom Rox products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-57256 attacked?

It is attacked with physical access, in a software library.

Am I affected by CVE-2024-57256?

Check whether you run Denx U-Boot or Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-57256: Das U-Boot integer overflow in ext4fs_read_symlink

CVE-2024-57256 · Severity: high · CVSS 7.1 · Published 2025-02-18

U-Boot is a widely used bootloader for embedded devices that initializes hardware and loads the operating system. A vulnerability in how it handles certain filesystem data could allow an attacker with physical access to bypass security protections like Verified Boot. This could lead to unauthorized code execution, potentially compromising the device's integrity and any sensitive data it handles.

Technologies: Denx U-Boot, Siemens RUGGEDCOM ROX II. Vendors: Denx, Siemens.

Quick answers

Is CVE-2024-57256 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-57256 being exploited in the wild.
How severe is CVE-2024-57256?: High severity, with a CVSS score of 7.1, published 18 February 2025.
Which products and versions are affected?: Siemens RUGGEDCOM ROX II before 2.17.1.
Is there a fix for CVE-2024-57256?: A patch was published on 2026-05-12: Siemens advisory published for Ruggedcom Rox products Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-57256 attacked?: It is attacked with physical access, in a software library.
Am I affected by CVE-2024-57256?: Check whether you run Denx U-Boot or Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer overflow exists in the ext4fs_read_symlink() function within Das U-Boot. The vulnerability occurs when the code adds one to an le32 variable representing the inode size during a zalloc() call. By providing a crafted ext4 filesystem with an inode size of 0xffffffff, the addition overflows to zero, leading to a zero-byte allocation. Subsequent data copying using the original large inode size results in a heap-based memory overwrite. This can be exploited by an attacker with physical access to the device (e.g., via a malicious USB drive or SD card) to bypass Verified Boot and achieve arbitrary code execution. The issue is fixed in U-Boot version 2025.01-rc1 and Siemens Ruggedcom Rox 2.17.1.

Affected products

Das U-Boot U-Boot before 2025.01-rc1
Siemens Ruggedcom Rox II family before 2.17.1

Timeline

2024-08-09: other: Patch authored
2025-02-17: disclosed: Public disclosure via Openwall mailing list
2025-02-18: advisory: NVD publication date
2026-05-12: patched: Siemens advisory published for Ruggedcom Rox products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.