Severity by source
Local vector reflects mandatory U-Boot shell prerequisite; PR:L for shell access; scope change because pre-boot ACE undermines the loaded OS.
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Heap buffer overflow in U-Boot's do_mv shell command (fs/fs.c) affects all versions through v2026.01-rc4 and allows an attacker with U-Boot shell access to corrupt pre-boot heap memory and potentially execute arbitrary code before any OS-level security controls activate. The flaw is rooted in missing bounds checks during string length addition when constructing move-command path arguments: integer overflow causes a heap under-allocation, which is then overflowed by an unchecked strcpy() call. No public exploit code or active exploitation has been identified, and the upstream fix is confirmed in v2026.04-rc1.
Technical ContextAI
U-Boot (Das U-Boot) is the dominant open-source bootloader for embedded Linux platforms, IoT devices, single-board computers, and ARM-based systems. CVE-2025-70291 is located in the fs/fs.c file's do_mv function, which implements the interactive U-Boot shell command for moving or renaming files across supported filesystems. The root cause is an integer overflow during the arithmetic addition of source and destination path string lengths, consistent with CWE-190 (Integer Overflow) leading to CWE-122 (Heap-based Buffer Overflow). When the summed length wraps around the integer type's maximum, the resulting value is passed to the heap allocator, which provisions an undersized buffer. The subsequent strcpy() then writes beyond that buffer boundary, corrupting adjacent heap memory. The sibling CVEs in this advisory family (CVE-2025-70290, -70292, -70293) follow the same pattern across ZFS, SquashFS, and EXT4 parsing components, and the upstream fix family applies compiler intrinsics such as __builtin_add_overflow or __builtin_mul_overflow to detect overflow before allocation occurs, as confirmed by the linked EXT4 diff.
Affected ProductsAI
Denx U-Boot all versions up to and including v2026.01-rc4 are confirmed affected across all supported hardware architectures and platform targets where the filesystem command set (including do_mv in fs/fs.c) is compiled in. The advisory imposes no restriction to specific chipsets or board configurations. The fixed release is v2026.04-rc1, incorporating upstream commit adccdb2. No CPE strings were included in the source data; the advisory references https://source.denx.de/u-boot/u-boot/-/commit/adccdb2 as the authoritative fix reference.
RemediationAI
The primary remediation is upgrading to U-Boot v2026.04-rc1 or any subsequent release containing upstream commit adccdb2, available at https://source.denx.de/u-boot/u-boot/-/commit/adccdb2. The patch introduces safe string-length addition using compiler intrinsics to detect integer overflow before the heap allocation occurs. For deployments where an immediate firmware upgrade is not operationally feasible, the following compensating controls should be applied in combination: enable U-Boot's boot password or autoboot stop-string protection (CONFIG_AUTOBOOT_STOP_STR, CONFIG_AUTOBOOT_KEYED_BOOTDELAY) to prevent unauthenticated shell access; physically secure serial console and JTAG ports on exposed devices; and disable network-accessible boot services (TFTP, NFS boot) if not operationally required. Note that disabling the mv command at build time (by not compiling CMD_FS_GENERIC or the relevant command) eliminates the specific attack surface but requires a firmware rebuild and may affect operational tooling. These mitigations depend on deployment-specific configuration and do not address the underlying vulnerability.
Share
External POC / Exploit Code
Leaving vuln.today