Denx U-Boot vulnerabilities

CVE-2019-13103 [HIGH] CWE-674 CVE-2019-13103: A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.

CVE-2024-57256 [MEDIUM] CWE-190 CVE-2024-57256: An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (addin An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.

CVE-2024-57259 [MEDIUM] CWE-193 CVE-2024-57259: sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap mem sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.

CVE-2024-57254 [MEDIUM] CWE-190 CVE-2024-57254: An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size c An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem.

CVE-2024-57255 [MEDIUM] CWE-190 CVE-2024-57255: An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted sq An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.

CVE-2017-3226 [MEDIUM] CWE-329 CVE-2017-3226: Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Device Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. Devices that make use of Das U-Boot's AES-CBC encryption feature using environment encryption (i.e., setting the configuration parameter CONFIG_ENV_AES=y) read environment variables from disk as the encrypted disk image is processed. An attacker with physical

CVE-2018-1000205 [MEDIUM] CWE-20 CVE-2018-1000205: U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validat U-Boot contains a CWE-20: Improper Input Validation vulnerability in Verified boot signature validation that can result in Bypass verified boot. This attack appear to be exploitable via Specially crafted FIT image and special device memory functionality.

CVE-2017-3225 [MEDIUM] CWE-329 CVE-2017-3225: Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For de Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data. Das U-Boot's AES-CBC encryption feature uses

CVE-2024-57257 [LOW] CWE-674 CVE-2024-57257: A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashf A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.