CVE-2024-57255

High CVSS: 7.1

An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.

Vendor

Denx

Product

U-boot

CWE

CWE-190

Yayın Tarihi

2025-02-18 23:15:09

Güncelleme

2025-11-03 20:16:54

Source Identifier

cve@mitre.org

KEV Date Added

Kategoriler

CWE-190 U-boot HIGH Denx 2025

Referanslar

https://source.denx.de/u-boot/u-boot/-/commit/233945eba63e24061dffeeaeb7cd6fe985278356 https://www.openwall.com/lists/oss-security/2025/02/17/2 https://lists.debian.org/debian-lts-announce/2025/05/msg00001.html

Benzer Kayıtlar

High

CVE-2026-33243

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport t…

High

CVE-2025-24857

Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qu…

Medium

CVE-2025-45512

A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attack…

High

CVE-2024-57254

An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a cra…

High

CVE-2024-57256

An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 var…

Low

CVE-2024-57257

A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with de…