EUVD-2026-29323
GHSA-vv9w-vff6-5rx9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network boot path enables adjacent-network exploitation without credentials; C:L reflects potential arbitrary disk offset reads per description; A:H for boot-time crash.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c. Attackers can supply a malicious ext4 filesystem image via USB, SD card, or network boot to trigger heap out-of-bounds reads during boot-time filesystem parsing, potentially redirecting reads to arbitrary disk offsets.
AnalysisAI
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 filesystem image - via USB, SD card, or network boot - to crash the bootloader during startup, preventing a device from completing its boot sequence. All barebox versions prior to v2026.04.0 fail to validate the eh_entries field in ext4 extent headers against actual buffer capacity in fs/ext4/ext4_common.c, enabling heap out-of-bounds reads that can additionally redirect parsing to arbitrary disk offsets. No public exploit has been identified at time of analysis; EPSS (0.01%, 2nd percentile) and SSVC (exploitation: none, automatable: no) both confirm low near-term exploitation probability, though the physical-media attack surface makes this relevant to embedded device supply chain and physical security programs.
Technical ContextAI
barebox is an open-source bootloader for embedded Linux systems, functionally analogous to U-Boot, executing during the earliest hardware initialization phase before the operating system loads. The vulnerability resides in fs/ext4/ext4_common.c within the ext4 extent tree parsing logic. CWE-125 (Out-of-Bounds Read) identifies the root cause: the parser trusts the eh_entries field of the ext4_extent_header structure - which declares the number of extent entries in a block - without verifying it does not exceed the actual allocated buffer size. For each excess entry, the code performs a heap read beyond the buffer boundary, a classic length-field trust flaw in a parser consuming untrusted external data. The CPE cpe:2.3:a:barebox:barebox:*:*:*:*:*:*:*:* covers all barebox versions before the fix. The release notes for v2026.04.0 authored by Sascha Hauer explicitly corroborate the fix, stating the ext4 code received 'more protection against crafted images.'
RemediationAI
The primary fix is to upgrade barebox to v2026.04.0 or later, available at https://github.com/barebox/barebox/releases/tag/v2026.04.0, published April 17, 2026. This release is confirmed by the maintainer Sascha Hauer to include hardening of the ext4 extent parsing code against crafted images. Organizations that cannot upgrade immediately should consider disabling ext4 filesystem support in their barebox build configuration if it is not required for the boot flow, eliminating the vulnerable code path at compile time with no runtime trade-off. As a physical-access compensating control, enforce strict physical security on target devices to prevent unauthorized insertion of USB drives or SD cards. For network boot environments, restrict TFTP and NFS server access to trusted, authenticated sources and validate boot image integrity via signed images or measured boot where supported - note that unsigned network boot remains a weaker defense. The VulnCheck advisory at https://www.vulncheck.com/advisories/barebox-ext4-extent-parsing-out-of-bounds-read provides additional technical context for remediation prioritization.
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest v
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length fiel
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length f
Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an in
Memory corruption in the barebox bootloader's EFI PE loader (efi/loader/pe.c) affects all versions prior to 2026.04.0, a
A signature bypass vulnerability exists in the barebox bootloader's FIT (Flattened Image Tree) image verification mechan
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same br
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesyste
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today