Executive brief
U-Boot is a widely used open-source bootloader responsible for initializing hardware and starting the operating system on embedded devices. A vulnerability in its networking component allows a nearby attacker to crash the device during the boot process by sending a specially crafted network packet. This can prevent the device from starting up successfully, leading to a denial of service that may require physical intervention to recover.
Technical details
An integer underflow exists in the tcp_rx_state_machine() function within net/tcp.c. When the bootloader is in the TCP_SYN_SENT state, it may process a malformed TCP SYN+ACK packet where a manipulated data offset field causes the payload_len calculation to result in a negative value. Because the TCP_SYN_SENT handler fails to invoke tcp_seg_in_wnd() validation, this negative value is implicitly converted to a large unsigned integer when passed to memcpy() in the store_block() function. This results in an out-of-bounds memory access and immediate crash. If CONFIG_LMB is disabled, this could potentially lead to further memory corruption. The vulnerability is exploitable by an unauthenticated attacker on the same local network segment.
Affected products
- Das U-Boot Project U-Boot through 2026.04-rc3
Timeline
- 2026-05-08: disclosed: Initial outreach to U-Boot mailing list by VulnCheck
- 2026-07-08: advisory: Public advisory released by VulnCheck and NVD record published