U-Boot CVE-2025-70290

Exploitation requires (1) U-Boot compiled with ZFS filesystem support enabled, and (2) the attacker's ability to supply malformed ZFS on-disk metadata that U-Boot reads during boot - i.e. control over an attached/removable storage device or a writable ZFS partition in the boot path. Limiting factors: the vulnerable ZFS code is not enabled in many U-Boot builds; the trigger is consumed only during the boot process, so the attacker needs local or physical access to the storage the device boots from (or a prior foothold that lets them write boot media), not network access; and devices that boot solely from fixed, integrity-protected, non-ZFS storage are not realistically reachable despite the CVSS AV:N label.

The signals conflict and must be weighed carefully. The published CVSS:3.1 vector is AV:N/AC:L/PR:N/UI:N (9.8, 'critical'), but the description says the trigger is 'malformed on-disk metadata' processed 'during the boot process' - that is a local/physical-storage vector, not a remote network one, so the AV:N rating is almost certainly wrong and inflates the score. EPSS agrees with the more sober reading: 0.17% (7th percentile) exploitation probability, there is no CISA KEV listing, and no confirmed exploitation. No SSVC decision was provided. Net assessment: this is a genuinely serious code-execution flaw in a trust-critical boot component (compromise here undermines secure/verified boot and any downstream trust), but it is not an internet-facing, mass-exploitable issue - an operator running a mid-sized fleet of embedded devices should prioritize it where devices boot from removable or externally writable ZFS storage, while low-EPSS and local-only reach mean it is not an emergency for devices that never touch attacker-controlled ZFS media. The high-CVSS-vs-low-real-reach gap should be resolved with the vendor before treating it as a network-critical item.

An attacker who can present a ZFS-formatted volume to the device - for example a malicious USB drive, SD card, or a tampered ZFS partition on attached storage - crafts on-disk metadata with values that overflow U-Boot's allocation math. When the device boots and U-Boot parses that ZFS metadata, the undersized buffer is overrun, letting the attacker crash the boot or execute code in the bootloader before the OS and its protections load. A gist reference is present in the feed that may contain proof-of-concept material, but its authenticity and functionality are unverified.