CVE-2024-42040: Buffer Overflow
Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/u-bootto a version that resolves this vulnerability.Fixed in 2023.01+dfsg-2+deb12u3 - Upgrade
Upgrade
debian/u-bootto a version that resolves this vulnerability.Fixed in 2025.01-3+deb13u1 - Upgrade
Upgrade
debian/u-bootto a version that resolves this vulnerability.Fixed in 2025.01-3.2 - Upgrade
Upgrade
debian/u-bootto a version that resolves this vulnerability.Fixed in 2023.01+dfsg-2+deb12u3Fixed in 2025.01-3+deb13u1Fixed in 2025.01-3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42040?
CVE-2024-42040 has been classified as a high severity vulnerability due to its potential to leak sensitive memory information.
How do I mitigate CVE-2024-42040?
To mitigate CVE-2024-42040, it is recommended to update to a patched version of DENEX U-Boot released after the vulnerability was identified.
What platforms are affected by CVE-2024-42040?
CVE-2024-42040 affects DENEX U-Boot on any platform that utilizes the affected code from its initial commit in 2002 to the present.
What is the impact of exploiting CVE-2024-42040?
Exploitation of CVE-2024-42040 could allow an attacker on the local network to leak between four to 32 bytes of memory.
Is CVE-2024-42040 a remote or local vulnerability?
CVE-2024-42040 is a local vulnerability that can only be exploited by an attacker within the same local network.