Executive brief
A vulnerability in the U-Boot and Barebox bootloaders could allow an attacker with physical or local administrative access to bypass secure boot protections. These bootloaders are responsible for verifying that the operating system and firmware are authentic before starting them. By exploiting this flaw, an attacker could replace legitimate system software with malicious code, potentially gaining full control over the device's hardware and data.
Technical details
A vulnerability exists in the Flat Image Tree (FIT) signature verification process within U-Boot and Barebox. When verifying a signed configuration, the bootloader relies on the 'hashed-nodes' property to determine which nodes were included in the signature hash. However, the 'hashed-nodes' property itself is not included in the hash, allowing an attacker with write access to the storage medium to modify this list. By manipulating this property, an attacker can trick the bootloader into skipping verification for malicious image nodes while still presenting a valid signature for the overall configuration. The fix involves ignoring the 'hashed-nodes' property and instead programmatically reconstructing the list of nodes that must be verified based on the configuration.
Affected products
- Das U-Boot U-Boot v2013.07 to v2025.10
- Barebox Barebox v2016.03.0 to v2026.02.0
Timeline
- 2026-03-02: disclosed: Privately reported by Apple SEAR
- 2026-03-09: patched: Fix committed to U-Boot master
- 2026-03-17: patched: Fixes included in barebox v2026.03.1 and v2026.09.3
- 2026-05-16: advisory: NVD publication of CVE-2026-46728