Most recent entries from all

fkie_cve-2025-70290

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.

GCVE-1988-2026-0377 — Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)

Affected: unknown

-----BEGIN SECURITY ADVISORY-----

Title: Multiple Integer Overflows in U-Boot Filesystem Handling Author: Timo Preißl <t.preissl () proton me> Date: 2026-02-11 CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293 Affected: Denx U-Boot <= v2026.01-rc4 Fixed in: v2026.04-rc1 (commit adccdb2)

== Overview ==

Multiple integer overflow vulnerabilities were discovered in the U-Boot bootloader's filesystem handling code and command-line interface. These flaws can lead to heap memory under-allocation followed by heap-based buffer overflows, potentially allowing Arbitrary Code Execution (ACE) in the pre-boot environment.

== Vulnerability Details ==

--- CVE-2025-70290: ZFS Metadata Integer Overflow ---

Component: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist Impact: A crafted ZFS filesystem image with malformed on-disk metadata can trigger an integer overflow during the size calculation passed to calloc(), resulting in an undersized allocation and subsequent out-of-bounds memory access. Fix: Validation of allocation size using __builtin_add_overflow.

--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---

Component: fs/fs.c, function do_mv Impact: Missing length checks in the directory move command allow an integer overflow during string length addition. An attacker with U-Boot shell access can trigger an under-allocation, resulting in a heap buffer overflow via strcpy(). Fix: Safe addition of string lengths using compiler intrinsics.

--- CVE-2025-70292…

GHSA-j2xx-grh4-4p3q

UBUNTU-CVE-2025-70290

Affected: Ubuntu:16.04:LTS: u-boot, Ubuntu:18.04:LTS: u-boot, Ubuntu:20.04:LTS: u-boot, Ubuntu:22.04:LTS: u-boot, Ubuntu:22.04:LTS: u-boot-nezha, Ubuntu:24.04:LTS: u-boot, Ubuntu:24.04:LTS: u-boot-nezha, Ubuntu:26.04:LTS: u-boot