Threat Intelligence Database

barebox versions prior to 2026.04.0 have an out-of-bounds read vulnerability in the DHCP option parsing code. The vulnerability occurs in the dhcp_message_type() function, which does not properly verify that the options pointer stays within the bounds of the received DHCP packet. An attacker on the same broadcast domain can exploit this by sending a crafted DHCP Offer or ACK packet missing the required 0xff end marker, causing the parser to read beyond valid data and potentially crash the system.

barebox versions prior to 2026.04.0 contain multiple memory-safety vulnerabilities in the EFI PE loader component. These include an integer overflow during virtual image size calculation and improper validation of PE section data boundaries. Exploitation can occur by supplying a malicious EFI PE binary via TFTP, USB, SD card, or network boot, potentially leading to heap buffer overflow or out-of-bounds reads. This may allow code execution within the bootloader context.

barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigger heap out-of-bounds reads during boot-time filesystem parsing, potentially redirecting reads to arbitrary disk offsets.

barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.