barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithmetic on section VirtualAddress and size values allows undersized heap allocation, and PE section loading logic fails to validate that PointerToRawData plus copied size remains within the PE file buffer. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot to trigger heap buffer overflow or out-of-bounds read from heap memory, potentially achieving code execution in bootloader context.

barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.

In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258.

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256.

barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within the dhcpmessagetype() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.

barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the ehentries field against buffer capacity in fs/ext4/ext4common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigger heap out-of-bounds reads during boot-time filesystem parsing, potentially redirecting reads to arbitrary disk offsets.

barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4common.c where the ext4fsiteratedir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.

Summary

- Identifier: sigma-star-sa-2024-003 - Vendor: - - Product/Software: Barebox - Affected versions: < v2025.01.0 - Fixed versions: v2025.01.0 - CVE IDs: CVE-2024-57260, CVE-2024-57261, CVE-2024-57262

Affected Product and Vendor barebox is a bootloader designed for embedded systems. It runs on a variety of architectures including x86, ARM, MIPS, RISC-V and others. barebox aims to be a versatile and flexible bootloader, not only for booting embedded Linux systems, but also for initial hardware bringup and development. barebox is highly configurable to be suitable as a full- featured development binary as well as for lean production systems. Just like busybox is the Swiss Army Knife for embedded Linux, barebox is the Swiss Army Knife for bare metal, hence the name. Source: https://barebox.org/

Description

Multuple vulnerabilities have been found in Barebox:

- CVE-2024-57260: Multiple vulnerabilities in Barebox’s SquashFS due to missing patches from Linux - CVE-2024-57261: Integer overflow in Barebox’s memory allocator - CVE-2024-57262: Integer overflow in Barebox’s SquashFS symlink resolution function

Impact

An attacker capable of modifying ext4 or SquashFS filesystem data structures can exploit multiple memory corruption vulnerabilities in Barebox. For systems that rely on verified boot, these vulnerabilities allow an attacker to bypass the chain of trust and achieve code execution by exploiting these issues. CVE-2024-57261 may also be exploited in Barebox through other subsystems than ext4 or SquashFS.

Mitigation

Upgrade to version v2025.01.0 or newer.

Patches

- https://git.pengutronix.de/cgit/barebox/commit/?id=ced445748477037e88f118b6d67409e0f3f2ea76 - https://git.pengutronix.de/cgit/barebox/commit/?id=12c3770203e2b264a796b43a54c6dd5f9fe3d2f0 - https://git.pengutronix.de/cgit/barebox/commit/?id=efe52dae380ab1e0bfdc2ee1575cf95da7061d99 - https://git.pengutronix.de/cgit/barebox/commit/?id=b8bd710ec1c90d032a461d57e522a8f985809278 - https://git.pengutronix.de/cgit/barebox/commit/?id=f034651371945a66069c2e9ff5a711211f650d0d - https://git.pengutronix.de/cgit/barebox/commit/?id=7cf25e0733f08f68d1bf0ca0c3cf6e2dfe51bd3c - https://git.pengutronix.de/cgit/barebox/commit/?id=a2b76550f7d87ba6f88a9ea50e71f107b514ff4e

Credits

- Richard Weinberger (sigma star gmbh - David Gstir (sigma star gmbh

-- ​​​​​sigma star gmbh | Eduard-Bodem-Gasse 6, 6020 Innsbruck, AUT UID/VAT Nr: ATU 66964118 | FN: 374287y