Executive brief
barebox, an open-source bootloader used in embedded systems like automotive and industrial devices, contains memory safety flaws in how it handles EFI executable files. An attacker with physical access or control over the boot media (such as a USB drive or SD card) could provide a specially crafted file that triggers a system crash or allows for unauthorized code execution during the boot process. This could lead to a full compromise of the device before the operating system even starts.
Technical details
Multiple memory-safety vulnerabilities exist in the EFI PE loader within `efi/loader/pe.c`. The first issue involves an integer overflow in the virtual image size computation using 32-bit arithmetic on `VirtualAddress` and size values, leading to an undersized heap allocation. The second issue is a lack of validation in the PE section loading logic, where the loader fails to ensure that `PointerToRawData` plus the copied size remains within the bounds of the PE file buffer. An attacker can exploit these by providing a malicious EFI PE binary via TFTP, USB, SD card, or network boot. Successful exploitation can result in a heap buffer overflow or out-of-bounds read, potentially allowing for arbitrary code execution in the bootloader context. The vulnerabilities were fixed in version 2026.04.0.
Affected products
- Pengutronix barebox prior to 2026.04.0
Timeline
- 2026-04-17: patched: barebox version 2026.04.0 released
- 2026-05-11: disclosed: Initial advisory publication