-----BEGIN SECURITY ADVISORY----- Title: Multiple Integer Overflows in U-Boot Filesystem Handling Author: Timo Preißl <[email protected]> Date: 2026-02-11 CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293 Affected: Denx U-Boot <= v2026.01-rc4 Fixed in: v2026.04-rc1 (commit adccdb2)
== Overview == Multiple integer overflow vulnerabilities were discovered in the U-Boot bootloader's filesystem handling code and command-line interface. These flaws can lead to heap memory under-allocation followed by heap-based buffer overflows, potentially allowing Arbitrary Code Execution (ACE) in the pre-boot environment. == Vulnerability Details == --- CVE-2025-70290: ZFS Metadata Integer Overflow --- Component: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist Impact: A crafted ZFS filesystem image with malformed on-disk metadata can trigger an integer overflow during the size calculation passed to calloc(), resulting in an undersized allocation and subsequent out-of-bounds memory access. Fix: Validation of allocation size using __builtin_add_overflow. --- CVE-2025-70291: Heap Buffer Overflow in do_mv Command --- Component: fs/fs.c, function do_mv Impact: Missing length checks in the directory move command allow an integer overflow during string length addition. An attacker with U-Boot shell access can trigger an under-allocation, resulting in a heap buffer overflow via strcpy(). Fix: Safe addition of string lengths using compiler intrinsics. --- CVE-2025-70292: SquashFS Integer Overflow --- Component: fs/squashfs/sqfs.c, function sqfs_concat_tokens Impact: Manipulated token lists trigger an overflow in sqfs_get_tokens_length(), causing heap under-allocation subsequently overflown by strcpy(). Fix: Validation of total token length before allocation. --- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow --- Component: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable Impact: An integer overflow in the block group descriptor table size calculation results in an undersized buffer being passed to memcpy(), causing memory corruption. Fix: Guarded multiplication of block group count and descriptor size. == Patch == All issues are fixed in the U-Boot master branch. Commit: adccdb2f605a6e8e046712398712398123 "fix integer overflows in filesystem code" https://source.denx.de/u-boot/u-boot/-/commit/adccdb2 == Timeline == Patch series submitted to upstream mailing list: https://lore.kernel.org/u-boot/[email protected]/T/ Fix merged: v2026.04-rc1 -----END SECURITY ADVISORY-----
