On 8/6/26 14:15, Arthur Chan wrote:
Hello U-Boot maintainers,
I'd like to report a High-severity security issue in U-Boot (https://
github.com/u-boot/u-boot / https://git.u-boot-project.org/u-boot/u-boot)
related to possible heap buffer overflow in U-Boot EFI image
verification under Secure Boot.
I have attached 3 files with this email as described below.
1) report.md: A full description of the vulnerability and how to
reproduce it, together with suggested fix of the issue.
2) Dockerfile: A Dockerfile for demonstrating the issue.
3) driver.c: Work with the Dockerfile to demonstrate the issue.
Attribution
*-----------*
Please attribute Claude and Ada Logics. This issue was found by
Anthropic from using agents to study security of open source projects,
and I am from Ada Logics helping validate the found issues and creating
the report manually and notify the maintainers.
Disclosure
*----------*
This report follows a 90-day coordinated disclosure deadline. I'm happy
to coordinate on the exact timing and to provide any further detail you
need.
Kind regards,
Arthur Chan
ADA Logics Ltd is registered in England. No: 11624074.
Registered office: 266 Banbury Road, Post Box 292,
OX2 7DL, Oxford, Oxfordshire , United Kingdom
@Ilias
There is no guarantee that the private exponent fits into 8 bytes. But
it would be highly unusual.
To be fully RSA compliant we probably would need to rewrite a lot of
code. An easier approach is probably to error out on long private exponents.
Best regards
Heinrich
