OESA-2026-4737: uboot-tools security update
This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fix(es):
U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply() function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the destination buffer, crashing the bootloader or corrupting memory.(CVE-2026-74220)
U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadlinkreply() function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader.(CVE-2026-74221)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/uboot-toolsto a version that resolves this vulnerability.Fixed in 2021.10-14.oe2203sp4 - Upgrade
Upgrade
uboot-toolsto a version that resolves this vulnerability.Fixed in 2026.10-rc5
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to operate or control a malicious NFS server and provide crafted NFS responses to the affected U-Boot NFS client. The flaws are triggered by crafted READ reply lengths or READLINK symlink length values.
Which boot scenarios are exposed?
Systems are exposed when U-Boot performs NFS operations against an attacker-controlled or untrusted NFS server. The provided information does not establish exposure for systems that do not use U-Boot NFS networking.
What is the likely impact of a successful attack?
A malicious NFS server can corrupt memory in the bootloader. The described outcomes include crashing the bootloader, and one issue can write far past the destination buffer.
What can be done if the update cannot be applied immediately?
Avoid using untrusted NFS servers during U-Boot boot or network operations. Restrict U-Boot NFS access to trusted servers and networks until the security update is installed.