Barebox
CVE-2019-15938
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy.
AnalysisAI
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Technical ContextAI
This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy. Affected products include: Pengutronix Barebox. Version information: through 2019.08.1.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest v
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length f
Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an in
Memory corruption in the barebox bootloader's EFI PE loader (efi/loader/pe.c) affects all versions prior to 2026.04.0, a
A signature bypass vulnerability exists in the barebox bootloader's FIT (Flattened Image Tree) image verification mechan
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same br
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesyste
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 fi
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today