GCVE-1988-2026-0379

Vulnerability from gna-1988 – Published: 2026-09-11 08:27 – Updated: 2026-09-11 08:27
VLAI
Title
[ADVISORY] Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)
Summary
-----BEGIN SECURITY ADVISORY----- Title: Multiple Integer Overflows in U-Boot Filesystem Handling Author: Timo Preißl <t.preissl () proton me> Date: 2026-02-11 CVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293 Affected: Denx U-Boot <= v2026.01-rc4 Fixed in: v2026.04-rc1 (commit adccdb2) == Overview == Multiple integer overflow vulnerabilities were discovered in the U-Boot bootloader's filesystem handling code and command-line interface. These flaws can lead to heap memory under-allocation followed by heap-based buffer overflows, potentially allowing Arbitrary Code Execution (ACE) in the pre-boot environment. == Vulnerability Details == --- CVE-2025-70290: ZFS Metadata Integer Overflow --- Component: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist Impact: A crafted ZFS filesystem image with malformed on-disk metadata can trigger an integer overflow during the size calculation passed to calloc(), resulting in an undersized allocation and subsequent out-of-bounds memory access. Fix: Validation of allocation size using __builtin_add_overflow. --- CVE-2025-70291: Heap Buffer Overflow in do_mv Command --- Component: fs/fs.c, function do_mv Impact: Missing length checks in the directory move command allow an integer overflow during string length addition. An attacker with U-Boot shell access can trigger an under-allocation, resulting in a heap buffer overflow via strcpy(). Fix: Safe addition of string lengths using compiler intrinsics. --- CVE-2025-70292: SquashFS Integer Overflow --- Component: fs/squashfs/sqfs.c, function sqfs_concat_tokens Impact: Manipulated token lists trigger an overflow in sqfs_get_tokens_length(), causing heap under-allocation subsequently overflown by strcpy(). Fix: Validation of total token length before allocation. --- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow --- Component: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable Impact: An integer overflow in the block group descriptor table size calculation results in an undersized buffer being passed to memcpy(), causing memory corruption. Fix: Guarded multiplication of block group count and descriptor size. == Patch == All issues are fixed in the U-Boot master branch. Commit: adccdb2f605a6e8e046712398712398123 "fix integer overflows in filesystem code" https://source.denx.de/u-boot/u-boot/-/commit/adccdb2 == Timeline == Patch series submitted to upstream mailing list: https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/ Fix merged: v2026.04-rc1 -----END SECURITY ADVISORY----- _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 445 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
unknown unknown Affected: unknown
guessed Create a notification for this product.
Credits
t.preissl via Fulldisclosure
Relationships
reference GCVE-1988-2026-0379 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unknown",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "t.preissl via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN SECURITY ADVISORY-----\n\nTitle: Multiple Integer Overflows in U-Boot Filesystem Handling\nAuthor: Timo Prei\u00dfl \u003ct.preissl () proton me\u003e\nDate: 2026-02-11\nCVEs: CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293\nAffected: Denx U-Boot \u003c= v2026.01-rc4\nFixed in: v2026.04-rc1 (commit adccdb2)\n\n== Overview ==\n\nMultiple integer overflow vulnerabilities were discovered in the U-Boot\nbootloader\u0027s filesystem handling code and command-line interface. These\nflaws can lead to heap memory under-allocation followed by heap-based\nbuffer overflows, potentially allowing Arbitrary Code Execution (ACE)\nin the pre-boot environment.\n\n== Vulnerability Details ==\n\n--- CVE-2025-70290: ZFS Metadata Integer Overflow ---\n\nComponent: fs/zfs/zfs.c, function zfs_nvlist_lookup_nvlist\nImpact: A crafted ZFS filesystem image with malformed on-disk metadata\ncan trigger an integer overflow during the size calculation\npassed to calloc(), resulting in an undersized allocation and\nsubsequent out-of-bounds memory access.\nFix: Validation of allocation size using __builtin_add_overflow.\n\n--- CVE-2025-70291: Heap Buffer Overflow in do_mv Command ---\n\nComponent: fs/fs.c, function do_mv\nImpact: Missing length checks in the directory move command allow an\ninteger overflow during string length addition. An attacker\nwith U-Boot shell access can trigger an under-allocation,\nresulting in a heap buffer overflow via strcpy().\nFix: Safe addition of string lengths using compiler intrinsics.\n\n--- CVE-2025-70292: SquashFS Integer Overflow ---\n\nComponent: fs/squashfs/sqfs.c, function sqfs_concat_tokens\nImpact: Manipulated token lists trigger an overflow in\nsqfs_get_tokens_length(), causing heap under-allocation\nsubsequently overflown by strcpy().\nFix: Validation of total token length before allocation.\n\n--- CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow ---\n\nComponent: fs/ext4/ext4_write.c, function ext4fs_get_bgdtable\nImpact: An integer overflow in the block group descriptor table size\ncalculation results in an undersized buffer being passed to\nmemcpy(), causing memory corruption.\nFix: Guarded multiplication of block group count and descriptor size.\n\n== Patch ==\n\nAll issues are fixed in the U-Boot master branch.\n\nCommit: adccdb2f605a6e8e046712398712398123\n\"fix integer overflows in filesystem code\"\n\nhttps://source.denx.de/u-boot/u-boot/-/commit/adccdb2\n\n== Timeline ==\n\nPatch series submitted to upstream mailing list:\nhttps://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl () proton me/T/\n\nFix merged: v2026.04-rc1\n-----END SECURITY ADVISORY-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T08:27:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/118"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/118"
        },
        {
          "url": "https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://source.denx.de/u-boot/u-boot/-/commit/adccdb2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/118"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[ADVISORY] Multiple Integer Overflows in U-Boot Filesystem Parsing (CVE-2025-70290 through CVE-2025-70293)",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-70290",
              "type": "related"
            },
            {
              "destId": "CVE-2025-70293",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0379",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/118",
            "automated": true,
            "contentSha256": "ede9cdc69b26403bb25c0cce5f648fe1b21aa472692a3d9d0b0800cb28eb176c",
            "evidenceScore": 5,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/118",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-08-27T13:30:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0379"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T08:27:55Z",
    "dateUpdated": "2026-09-11T08:27:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0379"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.