Executive brief
U-Boot is a widely-used bootloader that initializes hardware and loads the operating system on embedded devices and servers. An integer overflow in ext4 filesystem handling causes a buffer to be under-allocated, allowing an attacker to overflow the buffer during memory operations. This could lead to arbitrary code execution during the boot process, enabling device compromise, data loss, or system outage.
Technical details
The vulnerability is an integer overflow in the ext4fs_get_bgdtable function that miscalculates buffer size, resulting in under-allocation. When the undersized buffer is subsequently used in memcpy(), a heap buffer overflow occurs. The vulnerability is reachable via a malicious ext4 filesystem image, which an attacker could present during boot (e.g., via USB, network boot, or a compromised storage device). Successful exploitation allows arbitrary code execution in the bootloader context. Patches are available in U-Boot version 2026.04 and later.
Affected products
- Denx U-Boot before 2026.04
Timeline
- 2026-08-26: disclosed
- 2026-04: patched: Fix available in U-Boot 2026.04 and later