CVE-2026-127916: MCUboot image hash span is not bounded against the slot, allowing a read past the flash area during image validation

bootutilimghash() computes the image digest over ihhdrsize + ihimgsize + ihprotecttlvsize bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutilimgvalidate() compares the image size against bootutilmaximagesize() only after the hash has been computed.

The callers bound part of the span, or none of it:

On the swap and overwrite upgrade path, bootvalidateslot() first runs the image header check (bootisheadervalid(), later bootcheckheadervalid()). Before MCUboot 2.2.0 that check covered only ihhdrsize + ihimgsize, so for every image the protected-TLV area (ihprotecttlvsize, a uint16t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ihprotecttlvsize, except for a compressed image in the secondary slot when MCUBOOTDECOMPRESSIMAGES (CONFIGBOOTDECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB. The serial recovery image-list and image-state handlers (bslist() and bsset() in boot/bootserial/src/bootserial.c) and Zephyr's single-slot and firmware loaders (boot/zephyr/singleloader.c, boot/zephyr/firmwareloader.c) call bootutilimgvalidate() with no header check at all, so on those paths ihimgsize is unbounded as well.

The image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication.

Whether a malformed header produces an actual read beyond the area depends on the flash backend:

Backends whose flasharearead() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read. With MCUBOOTHASHSTORAGEDIRECTLY (Zephyr CONFIGBOOTIMGHASHDIRECTLYONSTORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check. The Cypress PSoC6 port's flasharearead() (boot/cypress/cyflashpal/cyflashmap.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy().

The bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path, and potentially much further on the paths that skip the header check. Where validation is repeated at every boot (a pending upgrade, or the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting.

The fix makes bootutilimghash() add the three sizes with bootu32safeadd() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller.