U Boot
by U Boot
Source repositories
CVEs (58)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-33967 | Hig | 0.51 | 7.8 | 0.01 | Jul 20, 2022 | squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition… | ||
| CVE-2022-33103 | Hig | 0.51 | 7.8 | 0.00 | Jul 1, 2022 | Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir(). | ||
| CVE-2022-30790 | Hig | 0.51 | 7.8 | 0.01 | Jun 8, 2022 | Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. | ||
| CVE-2021-27138 | Hig | 0.51 | 7.8 | 0.01 | Feb 17, 2021 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT. | ||
| CVE-2021-27097 | Hig | 0.51 | 7.8 | 0.01 | Feb 17, 2021 | The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. | ||
| CVE-2020-10648 | Hig | 0.51 | 7.8 | 0.01 | Mar 19, 2020 | Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration. | ||
| CVE-2019-13106 | Hig | 0.51 | 7.8 | 0.02 | Aug 6, 2019 | Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution. | ||
| CVE-2019-13105 | Hig | 0.51 | 7.8 | 0.01 | Aug 6, 2019 | Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem. | ||
| CVE-2019-13104 | Hig | 0.51 | 7.8 | 0.01 | Aug 6, 2019 | In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) while reading a crafted ext4 filesystem. | ||
| CVE-2018-18440 | Hig | 0.51 | 7.8 | 0.01 | Nov 20, 2018 | DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled. | ||
| CVE-2025-24857 | Hig | 0.49 | 7.6 | 0.00 | Dec 10, 2025 | Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code. | ||
| CVE-2026-74222 | Hig | 0.46 | 8.2 | 0.00 | Sep 29, 2026 | U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to… | ||
| CVE-2026-74221 | Hig | 0.46 | 8.2 | 0.00 | Sep 29, 2026 | U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash… | ||
| CVE-2026-74220 | Hig | 0.46 | 8.2 | 0.00 | Sep 29, 2026 | U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and… | ||
| CVE-2026-71971 | Hig | 0.46 | 8.2 | 0.00 | Sep 29, 2026 | U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt… | ||
| CVE-2026-29009 | Hig | 0.46 | 8.2 | 0.01 | Jul 8, 2026 | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink… | ||
| CVE-2026-46728 | Hig | 0.46 | 8.2 | 0.00 | May 16, 2026 | Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash. | ||
| CVE-2024-57259 | Hig | 0.46 | 7.1 | 0.00 | Feb 18, 2025 | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation. | ||
| CVE-2024-57258 | Hig | 0.46 | 7.1 | 0.00 | Feb 18, 2025 | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64. | ||
| CVE-2024-57256 | Hig | 0.46 | 7.1 | 0.00 | Feb 18, 2025 | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite. |
- risk 0.51cvss 7.8epss 0.01
squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition…
- risk 0.51cvss 7.8epss 0.00
Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir().
- risk 0.51cvss 7.8epss 0.01
Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552.
- risk 0.51cvss 7.8epss 0.01
The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT.
- risk 0.51cvss 7.8epss 0.01
The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT.
- risk 0.51cvss 7.8epss 0.01
Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration.
- risk 0.51cvss 7.8epss 0.02
Das U-Boot versions 2016.09 through 2019.07-rc4 can memset() too much data while reading a crafted ext4 filesystem, which results in a stack buffer overflow and likely code execution.
- risk 0.51cvss 7.8epss 0.01
Das U-Boot versions 2019.07-rc1 through 2019.07-rc4 can double-free a cached block of data when listing files in a crafted ext4 filesystem.
- risk 0.51cvss 7.8epss 0.01
In Das U-Boot versions 2016.11-rc1 through 2019.07-rc4, an underflow can cause memcpy() to overwrite a very large amount of data (including the whole stack) while reading a crafted ext4 filesystem.
- risk 0.51cvss 7.8epss 0.01
DENX U-Boot through 2018.09-rc1 has a locally exploitable buffer overflow via a crafted kernel image because filesystem loading is mishandled.
- risk 0.49cvss 7.6epss 0.00
Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code.
- risk 0.46cvss 8.2epss 0.00
U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERR_BUF instead of ERR_ABRT, causing the TCP input path to…
- risk 0.46cvss 8.2epss 0.00
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash…
- risk 0.46cvss 8.2epss 0.00
U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and…
- risk 0.46cvss 8.2epss 0.00
U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt…
- risk 0.46cvss 8.2epss 0.01
U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink…
- risk 0.46cvss 8.2epss 0.00
Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash.
- risk 0.46cvss 7.1epss 0.00
sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.
- risk 0.46cvss 7.1epss 0.00
Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.
- risk 0.46cvss 7.1epss 0.00
An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.
Page 2 of 3