U-Boot CVE-2025-70292

U-Boot is an open-source bootloader widely deployed across embedded Linux, IoT, and ARM-based systems. CVE-2025-70292 resides in the SquashFS driver at fs/squashfs/sqfs.c in the sqfs_concat_tokens function. That function calls sqfs_get_tokens_length() to compute the total length of a token list before allocating heap memory; an integer overflow at that calculation yields a value smaller than required, causing the allocator to produce an undersized buffer. The subsequent strcpy() then writes beyond the allocated region, producing a heap-based buffer overflow. This is a classic CWE-190 (Integer Overflow or Wraparound) pattern that directly leads to CWE-122 (Heap-based Buffer Overflow). Critically, the vulnerability exists in the pre-OS bootloader execution context, where OS-level mitigations such as ASLR, stack canaries, and NX enforcement are typically absent or minimal, materially increasing the practical impact of any successful exploitation. No CPE strings were supplied with this advisory.