CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-57255
https://notcve.org/view.php?id=CVE-2024-57255
18 Feb 2025 — An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite. • https://source.denx.de/u-boot/u-boot/-/commit/233945eba63e24061dffeeaeb7cd6fe985278356 • CWE-190: Integer Overflow or Wraparound •
CVSS: 2.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-57257
https://notcve.org/view.php?id=CVE-2024-57257
18 Feb 2025 — A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. • https://source.denx.de/u-boot/u-boot/-/commit/4f5cc096bfd0a591f8a11e86999e3d90a9484c34 • CWE-674: Uncontrolled Recursion •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-57254
https://notcve.org/view.php?id=CVE-2024-57254
18 Feb 2025 — An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem. • https://source.denx.de/u-boot/u-boot/-/commit/c8e929e5758999933f9e905049ef2bf3fe6b140d • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-57258
https://notcve.org/view.php?id=CVE-2024-57258
18 Feb 2025 — Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64. • https://source.denx.de/u-boot/u-boot/-/commit/0a10b49206a29b4aa2f80233a3e53ca0466bb0b3 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-57256
https://notcve.org/view.php?id=CVE-2024-57256
18 Feb 2025 — An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite. • https://source.denx.de/u-boot/u-boot/-/commit/35f75d2a46e5859138c83a75cd2f4141c5479ab9 • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-57259
https://notcve.org/view.php?id=CVE-2024-57259
18 Feb 2025 — sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation. • https://source.denx.de/u-boot/u-boot/-/commit/048d795bb5b3d9c5701b4855f5e74bcf6849bf5e • CWE-193: Off-by-one Error •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2019-6268 – RAD SecFlow-2 Path Traversal
https://notcve.org/view.php?id=CVE-2019-6268
05 Mar 2024 — RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs beginning with /.. for Directory Traversal, as demonstrated by reading /etc/shadow. Los dispositivos RAD SecFlow-2 con Hardware 0202, Firmware 4.1.01.63 y U-Boot 2010.12 permiten URI que comienzan con /.. para Directory Traversal, como se demuestra al leer /etc/shadow. RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 suffer from a directory traversal vulnerability. • https://packetstorm.news/files/id/177440 • CWE-31: Path Traversal: 'dir\..\..\filename' •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2347 – Unchecked Download size in Uboot
https://notcve.org/view.php?id=CVE-2022-2347
23 Sep 2022 — There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer. Se presenta un campo de longitud no comprobado en UBoot. La implementación de U-Boot DFU no vincula el... • https://seclists.org/oss-sec/2022/q3/41 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 28EXPL: 1CVE-2022-33967 – Ubuntu Security Notice USN-5764-1
https://notcve.org/view.php?id=CVE-2022-33967
20 Jul 2022 — squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution. Una implementación del sistema de archivos squashfs de las versiones de U-Boot versiones desde la v2020.10-rc2 hasta v2022.07-rc5, contiene una vulnerabilidad de desbordamiento de búfer en la región heap... • https://jvn.jp/en/vu/JVNVU97846460/index.html • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-33103 – Ubuntu Security Notice USN-5764-1
https://notcve.org/view.php?id=CVE-2022-33103
01 Jul 2022 — Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir(). Se ha detectado que Das U-Boot desde versiones v2020.10 a v2022.07-rc3, contiene una escritura fuera de límites por medio de la función sqfs_readdir() It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. Nicolas Bidron... • https://lore.kernel.org/all/20220609140206.297405-1-miquel.raynal%40bootlin.com • CWE-787: Out-of-bounds Write •