Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an… (CVE-2024-42040)

CVE-2024-42040 is a buffer overflow vulnerability in the net/bootp.c file of DENEX U-Boot present from its initial commit in 2002 through all current versions on any platform. An attacker on the local network can exploit this by sending crafted DHCP responses that cause leakage of 4 to 32 bytes of memory beyond the packet boundary. This memory leak depends on how DHCP parameters are later used. The vulnerability affects numerous Ubuntu versions of U-Boot, including multiple LTS releases from 16.04 through 26.04 and other versions. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, reflecting a high impact on confidentiality and availability without requiring privileges or user interaction.

An attacker on the local network can exploit this vulnerability to leak sensitive memory contents from the affected device, potentially exposing confidential information. The vulnerability also impacts availability, possibly causing denial of service conditions. There is no reported impact on integrity. The CVSS score of 8.1 reflects a high severity in confidentiality and availability impacts. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the input data. Until a patch is available, network administrators should consider limiting exposure of vulnerable devices to untrusted local networks or DHCP servers. Monitor vendor channels for updates and apply official fixes once released.