An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4… (CVE-2024-57256)

CVE-2024-57256 describes an integer overflow in the ext4fs_read_symlink function of Das U-Boot prior to 2025.01-rc1. The vulnerability arises from adding one to a 32-bit little-endian variable representing inode size, which can overflow when the inode size is set to 0xffffffff. This results in a zero-sized memory allocation (malloc(0)) and a consequent memory overwrite. An attacker can exploit this by providing a specially crafted ext4 filesystem to cause U-Boot to crash or execute arbitrary code.

Successful exploitation of this vulnerability can cause U-Boot to crash, resulting in denial of service, or potentially allow execution of arbitrary code with high impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.1, indicating a high severity with attack vector being physical (local), high attack complexity, no privileges required, no user interaction, and scope changed.

A patch is available and should be applied to affected U-Boot packages. Ubuntu has released fixed versions for multiple releases, including 24.04 LTS and 22.04 LTS. Users should update to the patched versions listed in the Ubuntu security notice USN-8056-1. Standard system updates will apply the necessary fixes.