Junglewise Threat Intelligence

CVE-2024-57258: Das U-Boot integer overflows in memory allocator

CVE-2024-57258 · Severity: high · CVSS 7.1 · Published 2025-02-18

Executive brief

U-Boot is a widely used bootloader for embedded devices that initializes hardware and starts the operating system. Multiple flaws in how it manages memory allocation could allow an attacker with physical access or the ability to modify storage media to execute malicious code. This could lead to a complete compromise of the device, bypassing security features like verified boot.

Technical details

Multiple integer overflows exist in U-Boot's dlmalloc implementation. Specifically, the sbrk() function fails to validate that a new heap break remains within the allocated bounds when an extremely large increment causes an unsigned long overflow. Additionally, the request2size() macro contains an improper cast of size_t to long, which can cause large allocation requests to wrap around and return a minimum size (MINSIZE), leading to heap-based buffer overflows. On x86_64 platforms, ptrdiff_t was also found to be improperly handled. An attacker can exploit these by providing a crafted SquashFS filesystem or through other subsystems that interact with the memory allocator. Successful exploitation allows for bypassing verified boot and achieving arbitrary code execution. Fixes are available in U-Boot v2025.01-rc1 and later.

Affected products

  • Denx Software Engineering U-Boot versions before 2025.01-rc1
  • Siemens Ruggedcom Rox II family versions before 2.17.1

Timeline

  • 2024-08-02: other: Patches authored by Richard Weinberger
  • 2025-02-17: disclosed: Public disclosure via oss-security mailing list
  • 2025-02-18: advisory: CVE published by NVD/MITRE
  • 2025-05-01: patched: Debian LTS update released (DLA-4150-1)
  • 2026-05-12: advisory: Siemens advisory SSA-577017 published for Ruggedcom Rox II family

References

Related threats