barebox CVE-2026-34961

The vulnerability is triggered when barebox parses an ext4 filesystem image during the boot-time initialization sequence. Specific conditions required: (1) the target device must run barebox prior to v2026.04.0 with ext4 filesystem support compiled into the build - devices using only FAT, UBIFS, or other non-ext4 filesystems at boot are not exposed; (2) the attacker must be able to deliver a malicious ext4 image via USB mass storage, SD/eMMC card, or a network boot source (TFTP/NFS server on the local network segment); (3) the device must attempt to read from the attacker-controlled media during boot. Network boot exploitation requires a position on the same network segment as the TFTP/NFS boot server or the ability to intercept that traffic. USB and SD card exploitation requires physical presence at the device. The vulnerability operates before any OS-level authentication mechanisms are active, meaning no credentials or session on the target system are required, but the attack is bounded to the boot phase and does not affect a running system.

The CVSS 4.0 score of 6.9 with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H reflects a local-access, low-complexity denial-of-service with high availability impact and no confidentiality or integrity effect per the vendor's scoring. EPSS at 0.01% (2nd percentile) and SSVC exploitation status of 'none' with automatable 'no' all converge on a low near-term exploitation probability - this is not currently being actively exploited and automated mass exploitation is not feasible given the physical delivery requirement. The primary real-world risk is to embedded devices where an adversary has physical access (USB/SD card insertion) or control over a network boot infrastructure (TFTP/NFS server). The 'Information Disclosure' tag and the description's mention of 'redirecting reads to arbitrary disk offsets' suggest a potential confidentiality impact not captured by the official VC:N rating - this discrepancy is noted but unresolved from available data. For vendors shipping products built on barebox, this represents a meaningful supply chain or insider threat concern, particularly for devices deployed in physically accessible environments.

An attacker with physical access to an embedded device formats a USB drive or SD card containing a crafted ext4 filesystem image in which the extent header's eh_entries field is set to a value far exceeding the actual buffer capacity. When the target device powers on and barebox attempts to parse this filesystem during boot, the missing bounds check causes a heap out-of-bounds read for each excess extent entry, crashing the bootloader and leaving the device unable to complete startup. No public proof-of-concept code has been confirmed at time of analysis, but the attack primitive is straightforward and achievable by any attacker familiar with the ext4 on-disk format.