Executive brief
RAUC is an update controller used to securely deploy software updates to embedded Linux devices. A flaw in how it handles large update files allows an attacker to modify the contents of an update even if it has a valid digital signature. This could allow an attacker to install malicious software on devices, potentially leading to full system takeover or data theft.
Technical details
An integer overflow vulnerability exists in RAUC's handling of 'plain' format bundles when the payload size exceeds 2 GiB. The overflow occurs during the signing and verification process, specifically involving OpenSSL's BIO_new_mem_buf(), causing the resulting cryptographic signature to cover only the first few bytes of the payload. An attacker with the ability to provide a signed bundle (e.g., via a compromised update server or man-in-the-middle) can append or modify data in the portion of the payload not covered by the signature. This allows for the execution of unauthorized code on the target embedded system. The issue is fixed in version 1.15.2 by rejecting 'plain' bundles larger than 2 GiB; users are encouraged to migrate to 'verity' or 'crypt' formats.
Affected products
- Pengutronix RAUC < 1.15.2
Timeline
- 2026-03-17: disclosed: Initial notification by Sony to Pengutronix
- 2026-03-27: patched: Version 1.15.2 released
- 2026-03-27: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE-2026-34155 published