Source: u-boot Version: 2025.01-3.2 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for u-boot. CVE-2026-29007[0]: | U-Boot through 2026.04-rc3 contains an out-of-bounds read | vulnerability in tcp_rx_state_machine() (net/tcp.c) when | CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond | TCP segment boundaries by crafting a malicious packet with a | mismatched IP total length and TCP data offset field. Attackers can | send a packet with an IP total length of 40 bytes and a TCP data | offset claiming 60 bytes of header to cause tcp_parse_options() to | read 40 bytes past the end of the TCP segment, potentially | corrupting connection state variables such as rmt_win_scale and | rmt_timestamp to disrupt TCP window calculations. CVE-2026-29008[1]: | U-Boot through 2026.04-rc3 contains an integer underflow | vulnerability in the tcp_rx_state_machine() function (net/tcp.c) | that allows a network-adjacent attacker to crash the bootloader by | sending a malformed TCP SYN+ACK packet with a manipulated data | offset field causing payload_len to become negative. When the | TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking | tcp_seg_in_wnd() validation, the negative payload_len is implicitly | converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed | to memcpy() in store_block(), causing an immediate crash that | prevents device boot and may enable memory corruption when | CONFIG_LMB is disabled. CVE-2026-29009[2]: | U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability | in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is | enabled, allowing a malicious or compromised NFS server to overflow | the 2048-byte nfs_path_buff buffer by returning multiple relative | symlink targets that are appended without cumulative length | validation. Attackers can send two or more READLINK responses | containing relative symlink targets of approximately 1100 bytes each | to corrupt adjacent BSS variables including nfs_server_ip, | nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and | rpc_id, potentially achieving memory corruption and control over the | NFS client state machine. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-29007 https://www.cve.org/CVERecord?id=CVE-2026-29007 [1] https://security-tracker.debian.org/tracker/CVE-2026-29008 https://www.cve.org/CVERecord?id=CVE-2026-29008 [2] https://security-tracker.debian.org/tracker/CVE-2026-29009 https://www.cve.org/CVERecord?id=CVE-2026-29009 [3] https://y637f9qq2x.com/posts/u-boot-tcp-nfs-vulns/ [4] https://lists.denx.de/pipermail/u-boot/2026-May/617853.html Please adjust the affected versions in the BTS as needed. Regards, Salvatore
