Is CVE-2024-57258 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-57258 being exploited in the wild.

How severe is CVE-2024-57258?

High severity, with a CVSS score of 7.1, published 18 February 2025.

Which products and versions are affected?

Siemens RUGGEDCOM ROX II versions before 2.17.1.

Is there a fix for CVE-2024-57258?

A patch was published on 2025-05-01: Debian LTS update released (DLA-4150-1) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-57258 attacked?

It is attacked with local access or with physical access, in a software library.

Am I affected by CVE-2024-57258?

Check whether you run Denx U-Boot or Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-57258: Das U-Boot integer overflows in memory allocator

CVE-2024-57258 · Severity: high · CVSS 7.1 · Published 2025-02-18

U-Boot is a widely used bootloader for embedded devices that initializes hardware and starts the operating system. Multiple flaws in how it manages memory allocation could allow an attacker with physical access or the ability to modify storage media to execute malicious code. This could lead to a complete compromise of the device, bypassing security features like verified boot.

Technologies: Denx U-Boot, Siemens RUGGEDCOM ROX II. Vendors: Denx, Siemens.

Quick answers

Is CVE-2024-57258 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-57258 being exploited in the wild.
How severe is CVE-2024-57258?: High severity, with a CVSS score of 7.1, published 18 February 2025.
Which products and versions are affected?: Siemens RUGGEDCOM ROX II versions before 2.17.1.
Is there a fix for CVE-2024-57258?: A patch was published on 2025-05-01: Debian LTS update released (DLA-4150-1) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-57258 attacked?: It is attacked with local access or with physical access, in a software library.
Am I affected by CVE-2024-57258?: Check whether you run Denx U-Boot or Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple integer overflows exist in U-Boot's dlmalloc implementation. Specifically, the sbrk() function fails to validate that a new heap break remains within the allocated bounds when an extremely large increment causes an unsigned long overflow. Additionally, the request2size() macro contains an improper cast of size_t to long, which can cause large allocation requests to wrap around and return a minimum size (MINSIZE), leading to heap-based buffer overflows. On x86_64 platforms, ptrdiff_t was also found to be improperly handled. An attacker can exploit these by providing a crafted SquashFS filesystem or through other subsystems that interact with the memory allocator. Successful exploitation allows for bypassing verified boot and achieving arbitrary code execution. Fixes are available in U-Boot v2025.01-rc1 and later.

Affected products

Denx Software Engineering U-Boot versions before 2025.01-rc1
Siemens Ruggedcom Rox II family versions before 2.17.1

Timeline

2024-08-02: other: Patches authored by Richard Weinberger
2025-02-17: disclosed: Public disclosure via oss-security mailing list
2025-02-18: advisory: CVE published by NVD/MITRE
2025-05-01: patched: Debian LTS update released (DLA-4150-1)
2026-05-12: advisory: Siemens advisory SSA-577017 published for Ruggedcom Rox II family

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.