OESA-2026-4735: uboot-tools security update
This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fix(es):
U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.(CVE-2026-74220)
U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadlinkreply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.(CVE-2026-74221)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/uboot-toolsto a version that resolves this vulnerability.Fixed in 2024.01-6.oe2403sp1 - Upgrade
Upgrade
U-Bootto a version that resolves this vulnerability.Fixed in 2026.10-rc5
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Prioritize U-Boot environments that process NFS READ or READLINK replies, particularly where the NFS server could be malicious or untrusted. The affected code is in U-Boot's NFS response handling during bootloader operation.
What does an attacker need to exploit these issues?
An attacker needs to act as, or control responses from, an NFS server and supply crafted NFS READ or READLINK reply lengths. The provided vector indicates network reachability is sufficient, with no privileges or user interaction required.
What is the likely impact of successful exploitation?
Crafted responses can write beyond the intended destination buffer and corrupt bootloader memory. The documented outcomes include crashing the bootloader and memory corruption; the severity vector rates availability impact as high and integrity impact as low.