GCVE-1988-2026-0377
Vulnerability from gna-1988 – Published: 2026-09-11 08:27 – Updated: 2026-09-11 08:27
VLAI
EPSS
VEX
Title
Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)
Summary
-----BEGIN SECURITY ADVISORY-----
Title: Multiple Integer Overflows in U-Boot Filesystem Handling
Author: Timo Preißl <t.preissl () proton me>
Date: 2026-02-11
CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293
Affected: Denx U-Boot <= v2026.01-rc4
Fixed in: v2026.04-rc1 (commit adccdb2)
== Overview ==
Multiple integer overflow vulnerabilities were discovered in the U-Boot
bootloader's filesystem handling code and command-line interface. These
flaws can lead to heap memory under-allocation followed by heap-based
buffer overflows, potentially allowing Arbitrary Code Execution (ACE)
in the pre-boot environment.
== Vulnerability Details ==
--- CVE-2025-70290: ZFS Metadata Integer Overflow ---
Component: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist
Impact: A crafted ZFS filesystem image with malformed on-disk metadata
can trigger an integer overflow during the size calculation
passed to calloc(), resulting in an undersized allocation and
subsequent out-of-bounds memory access.
Fix: Validation of allocation size using __builtin_add_overflow.
--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---
Component: fs/fs.c, function do_mv
Impact: Missing length checks in the directory move command allow an
integer overflow during string length addition. An attacker
with U-Boot shell access can trigger an under-allocation,
resulting in a heap buffer overflow via strcpy().
Fix: Safe addition of string lengths using compiler intrinsics.
--- CVE-2025-70292: SquashFS Integer Overflow ---
Component: fs/squashfs/sqfs.c, function sqfs_concat_tokens
Impact: Manipulated token lists trigger an overflow in
sqfs_get_tokens_length(), causing heap under-allocation
subsequently overflown by strcpy().
Fix: Validation of total token length before allocation.
--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---
Component: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable
Impact: An integer overflow in the block group descriptor table size
calculation results in an undersized buffer being passed to
memcpy(), causing memory corruption.
Fix: Guarded multiplication of block group count and descriptor size.
== Patch ==
All issues are fixed in the U-Boot master branch.
Commit: adccdb2f605a6e8e046712398712398123
"fix integer overflows in filesystem code"
https://source.denx.de/u-boot/u-boot/-/commit/adccdb2
== Timeline ==
Patch series submitted to upstream mailing list:
https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/
Fix merged: v2026.04-rc1
-----END SECURITY ADVISORY-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
Relationships
reference
GCVE-1988-2026-0377 (this record)
- related CVE-2025-70290
- related CVE-2025-70293
{
"containers": {
"cna": {
"affected": [
{
"product": "unknown",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "t.preissl via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN SECURITY ADVISORY-----\n\nTitle: Multiple Integer Overflows in U-Boot Filesystem Handling\nAuthor: Timo Prei\u00dfl \u003ct.preissl () proton me\u003e\nDate: 2026-02-11\nCVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293\nAffected: Denx U-Boot \u003c= v2026.01-rc4\nFixed in: v2026.04-rc1 (commit adccdb2)\n\n== Overview ==\n\nMultiple integer overflow vulnerabilities were discovered in the U-Boot\nbootloader\u0027s filesystem handling code and command-line interface. These\nflaws can lead to heap memory under-allocation followed by heap-based\nbuffer overflows, potentially allowing Arbitrary Code Execution (ACE)\nin the pre-boot environment.\n\n== Vulnerability Details ==\n\n--- CVE-2025-70290: ZFS Metadata Integer Overflow ---\n\nComponent: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist\nImpact: A crafted ZFS filesystem image with malformed on-disk metadata\ncan trigger an integer overflow during the size calculation\npassed to calloc(), resulting in an undersized allocation and\nsubsequent out-of-bounds memory access.\nFix: Validation of allocation size using __builtin_add_overflow.\n\n--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---\n\nComponent: fs/fs.c, function do_mv\nImpact: Missing length checks in the directory move command allow an\ninteger overflow during string length addition. An attacker\nwith U-Boot shell access can trigger an under-allocation,\nresulting in a heap buffer overflow via strcpy().\nFix: Safe addition of string lengths using compiler intrinsics.\n\n--- CVE-2025-70292: SquashFS Integer Overflow ---\n\nComponent: fs/squashfs/sqfs.c, function sqfs_concat_tokens\nImpact: Manipulated token lists trigger an overflow in\nsqfs_get_tokens_length(), causing heap under-allocation\nsubsequently overflown by strcpy().\nFix: Validation of total token length before allocation.\n\n--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---\n\nComponent: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable\nImpact: An integer overflow in the block group descriptor table size\ncalculation results in an undersized buffer being passed to\nmemcpy(), causing memory corruption.\nFix: Guarded multiplication of block group count and descriptor size.\n\n== Patch ==\n\nAll issues are fixed in the U-Boot master branch.\n\nCommit: adccdb2f605a6e8e046712398712398123\n\"fix integer overflows in filesystem code\"\n\nhttps://source.denx.de/u-boot/u-boot/-/commit/adccdb2\n\n== Timeline ==\n\nPatch series submitted to upstream mailing list:\nhttps://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/\n\nFix merged: v2026.04-rc1\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T08:27:55Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/119"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/119"
},
{
"url": "https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://source.denx.de/u-boot/u-boot/-/commit/adccdb2"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/119"
],
"discovery": "EXTERNAL"
},
"title": "Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2025-70290",
"type": "related"
},
{
"destId": "CVE-2025-70293",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0377",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/119",
"automated": true,
"contentSha256": "fbc113ddbae742d7683314d4afdd309dbb88dada1172712fb6d80816bd39b11f",
"evidenceScore": 5,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/119",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-28T15:58:35Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0377"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T08:27:55Z",
"dateUpdated": "2026-09-11T08:27:55Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0377"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…