An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of… (CVE-2024-57255)

CVE-2024-57255 describes an integer overflow in the sqfs_resolve_symlink function within Das U-Boot versions prior to 2025.01-rc1. The vulnerability arises from improper handling of inode size calculations in squashfs filesystems, specifically when the inode size is set to 0xffffffff. This triggers a zero-byte malloc call, which leads to memory overwrite conditions. Exploitation of this flaw can cause denial of service via crashes or enable arbitrary code execution. The vulnerability has a CVSS 3.1 score of 7.1, indicating a medium severity level, with network attack vector requiring high attack complexity and no privileges or user interaction needed. Multiple Ubuntu U-Boot package versions are affected, and an official patch is available as detailed in the Ubuntu security notice USN-8056-1.

Successful exploitation of this vulnerability can result in denial of service due to U-Boot crashes or potentially arbitrary code execution. The CVSS score of 7.1 reflects high impact on confidentiality, integrity, and availability. The attack vector is physical or local (per CVSS AV:P), requiring high complexity and no privileges or user interaction. This could allow an attacker with access to a crafted squashfs filesystem to compromise the bootloader environment.

An official patch is available and should be applied to affected systems. Ubuntu has released fixed package versions for multiple U-Boot packages across supported LTS releases. Users should update their U-Boot packages to the patched versions listed in Ubuntu Security Notice USN-8056-1. Applying these updates will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.