Threats affecting pkg:github/u-boot/u-boot

U-Boot versions prior to 2026.10-rc4 contain an integer overflow vulnerability in the sqfs_read_directory_table() function. This flaw occurs when processing a crafted SquashFS image with a malicious superblock metablks_count value, leading to heap buffer under-allocation and out-of-bounds writes. The vulnerability can cause heap memory corruption and bootloader crashes. The CVSS 3.1 base score is 5.2, indicating medium severity. No known exploits are reported in the wild. Affected versions include many specific Ubuntu package versions and all versions before 2026.10-rc4.

U-Boot versions up to 2026.10-rc5 contain an out-of-bounds write vulnerability in the video_display_rle8_bitmap function within drivers/video/video_bmp.c. This flaw allows specially crafted RLE8-compressed BMP images to corrupt memory adjacent to the framebuffer, potentially causing the bootloader to crash. The vulnerability has a medium severity with a CVSS score of 5.9.

U-Boot versions prior to 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contain an out-of-bounds write vulnerability in the __net_defragment() function. This vulnerability allows remote attackers to send crafted IP fragments during netboot, potentially corrupting adjacent memory and causing the bootloader to crash. The vulnerability has a CVSS score of 8.2, indicating a medium severity level. A patch is available to address this issue.

U-Boot versions prior to 2026.10-rc5 contain a buffer overflow vulnerability in the nfs_read_reply() function. This flaw arises from signed integer handling errors that allow a malicious NFS server to bypass length validation and write beyond the intended buffer, potentially causing memory corruption or bootloader crashes. The vulnerability has a CVSS score of 8.2, indicating a medium severity level. A patch is available to address this issue.

U-Boot versions prior to 2026.10-rc5 contain an out-of-bounds memory access vulnerability in the dhcp6_parse_options() function due to improper validation of SERVERID and CLIENTID option lengths in DHCPv6 packets. This vulnerability can be exploited by an attacker on the local network sending crafted DHCPv6 ADVERTISE or REPLY packets during netboot, potentially causing memory corruption and crashing the bootloader. The vulnerability has a CVSS score of 7.1 (medium severity). A patch is available to address this issue.

U-Boot versions prior to 2026.10-rc3 contain an out-of-bounds write vulnerability in the read_slotted_partition() function. This occurs because the image size is not properly validated against partition bounds, allowing crafted boot media with oversized headers to cause memory corruption. The vulnerability affects devices without Android Verified Boot protection and requires physical access to exploit. The CVSS score is 4.8, indicating medium severity.

U-Boot versions prior to 2026.10-rc5 contain a use-after-free vulnerability in the httpc_recv_cb() function of the lwIP wget implementation. This vulnerability arises when HTTP data storage fails, causing the callback to free the connection PCB but return an incorrect error code, leading to access of freed memory and potential bootloader crash. The flaw can cause denial of service by crashing the bootloader but does not impact confidentiality or integrity. A patch is available to address this issue.

U-Boot versions prior to 2026.10-rc5 contain a buffer overflow vulnerability in the nfs_readlink_reply() function when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values, leading to memory corruption and causing the bootloader to crash. This vulnerability has a CVSS score of 8.2, indicating a medium severity impact primarily affecting availability. A patch is available to address this issue.

Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses.