OESA-2026-4736: uboot-tools security update
This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fix(es):
U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.(CVE-2026-74220)
U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadlinkreply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.(CVE-2026-74221)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/uboot-toolsto a version that resolves this vulnerability.Fixed in 2024.01-6.oe2403sp3 - Upgrade
Upgrade
uboot-toolsto a version that resolves this vulnerability.Fixed in 2026.10-rc5
Event History
Frequently Asked Questions
Who is exposed to these flaws?
Systems using affected U-Boot versions that process NFS READ or READLINK responses are exposed. The vulnerable code is in U-Boot's NFS response handling, and the affected package is openeuler/uboot-tools.
What does an attacker need to exploit the issue?
An attacker needs to operate or control a malicious NFS server that can provide crafted NFS replies to the bootloader. No privileges or user interaction are indicated by the supplied CVSS vector.
What is the impact of successful exploitation?
Crafted reply lengths can cause writes far beyond a destination buffer, leading to memory corruption or a bootloader crash. One issue is rated as affecting integrity and availability, while the other description specifically notes memory corruption and crashes.
Which versions contain the vulnerable code?
U-Boot versions before 2026.10-rc5 are affected by both CVE-2026-74220 and CVE-2026-74221.