OESA-2026-4843: uboot-tools security update
This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fwprintenv and fwsetenv programs to read and modify U-Boot's environment. Security Fix(es):
U-Boot before 2026.10-rc3 with CONFIGIPDEFRAG enabled contains an out-of-bounds write vulnerability in the netdefragment() function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the bootloader.(CVE-2026-71971)
U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the videodisplayrle8bitmap function in drivers/video/videobmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.(CVE-2026-71972)
U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable() function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.(CVE-2026-71973)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/uboot-toolsto a version that resolves this vulnerability.Fixed in 2024.01-7.oe2403sp3 - Upgrade
Upgrade
U-Bootto a version that resolves this vulnerability.Fixed in 2026.10-rc4 - Upgrade
Upgrade
U-Bootto a version that resolves this vulnerability.Fixed in 2026.10-rc5
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Is the network-reachable issue enabled by default?
The data only identifies systems with CONFIG_IP_DEFRAG enabled as affected by the IP-fragment flaw. It does not state whether this configuration is enabled by default; exploitation is described as occurring during netboot.
What attacker-controlled input is needed for the non-network issues?
The video issue requires a crafted RLE8-compressed BMP image. The SquashFS issue requires a crafted SquashFS image with an attacker-controlled superblock metablks_count value.
What impact should be expected from successful exploitation?
The described vulnerabilities can corrupt memory adjacent to the affected buffer or framebuffer, or corrupt heap memory. The stated outcome is a bootloader crash.
How can an administrator identify potentially exposed deployments?
Check whether the U-Boot build enables CONFIG_IP_DEFRAG and performs netboot operations. Also identify boot flows that process externally supplied RLE8 BMP images or SquashFS images.
Does the advisory provide an openEuler package version containing the fix?
No specific fixed openEuler uboot-tools package version is included in the provided data.