U-Boot CVE-2025-70291

Exploitation requires that the attacker already holds an interactive U-Boot shell session - do_mv is a shell-layer command, not reachable from a running OS or over the network without first having console access during the boot window. The U-Boot prompt is typically gated by physical serial console (UART/JTAG) or, in network-boot configurations, accessible over the local network only during the pre-OS boot stage. The vulnerability is not exploitable from a running operating system instance. No specific filesystem image or mounted volume is required; the overflow occurs in path string arithmetic within do_mv itself before any filesystem I/O. No user interaction beyond the attacker's own shell input is required. The limiting factors are: physical or boot-time console access as a hard prerequisite, U-Boot version ≤ v2026.01-rc4 with filesystem command support compiled in, and no boot-prompt password or autoboot protection configured on the target device.

No CVSS vector or EPSS score was provided; metrics below are independently assessed. The most significant real-world constraint is the prerequisite of U-Boot shell access, which typically requires physical serial console (UART), JTAG access, or - in network-boot deployments - access during the boot window before the OS loads. This substantially narrows the realistic attacker population relative to what a raw severity score might suggest. The vulnerability is not in CISA KEV and no POC has been identified, consistent with the relatively niche access requirement. However, for threat models involving physical access, supply-chain attacks on embedded firmware, or devices with exposed U-Boot network interfaces (TFTP, NFS), the impact is severe: arbitrary code execution in the pre-boot environment bypasses all OS security controls, secure boot attestation can be undermined, and persistent implantation is feasible. High-sensitivity embedded contexts - medical devices, automotive ECUs, industrial controllers, network appliances - warrant priority patching. General enterprise environments are largely unaffected unless managing embedded infrastructure.

An attacker with access to the U-Boot interactive shell - obtained, for example, via an exposed UART serial port on an IoT gateway or an unsecured network-boot endpoint during the boot window - executes the mv command with source and destination path arguments whose combined lengths are carefully sized to wrap a signed integer. The resulting undersized heap allocation is overflowed by the subsequent strcpy() call, corrupting heap metadata or adjacent allocator structures. With sufficient control over the overflow, the attacker achieves arbitrary code execution in the pre-boot context, enabling firmware backdooring or bypassing secure boot verification before the target OS loads.