EUVD-2026-29325
GHSA-gh28-ww79-7h4v
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector because media write access is required; PR:N since no OS privileges needed to craft the image; only high availability impact with no C/I consequences.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.
AnalysisAI
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesystem image to permanently hang the boot process of affected embedded devices. Versions prior to 2026.04.0 are affected via CWE-835 (unreachable loop exit) in ext4fs_iterate_dir() when it encounters a directory entry with a direntlen of zero. No public exploit has been identified and CISA has not added this to KEV; however, the impact of a permanently hung bootloader is a complete availability loss for the affected device.
Technical ContextAI
barebox is an embedded bootloader (CPE: cpe:2.3:a:barebox:barebox:*:*:*:*:*:*:*:*) analogous to U-Boot, primarily used in embedded Linux systems. The vulnerability resides in fs/ext4/ext4_common.c within the ext4fs_iterate_dir() function, which iterates over ext4 directory entries during path resolution or directory listing at boot time. CWE-835 (Loop with Unreachable Exit Condition) describes the root cause: the loop advances its position pointer by adding direntlen to the current offset, but if direntlen is zero the pointer never advances and the loop runs forever. This is a classic missing input validation flaw on a length field parsed from untrusted external media. The ext4 parsing code is exercised during boot when barebox reads kernels, device trees, or initrd images from ext4 partitions.
RemediationAI
Upgrade barebox to v2026.04.0 or later, which is confirmed to include ext4 code hardening against crafted images per the release notes authored by Sascha Hauer (https://github.com/barebox/barebox/releases/tag/v2026.04.0). If upgrading the bootloader is not immediately feasible, a targeted workaround is to configure barebox to boot exclusively from filesystems other than ext4 (e.g., FAT32/vfat), removing the vulnerable code path entirely; the trade-off is a change to the storage layout and partition scheme. Additionally, enabling secure boot or enforcing cryptographic verification of storage media before the bootloader reads directory structures would prevent an attacker from supplying a malicious image, though this requires platform-specific secure boot infrastructure. Physical security controls (tamper-evident seals, locked enclosures) reduce the most likely attack vector for embedded devices in the field.
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest v
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length fiel
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length f
Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an in
Memory corruption in the barebox bootloader's EFI PE loader (efi/loader/pe.c) affects all versions prior to 2026.04.0, a
A signature bypass vulnerability exists in the barebox bootloader's FIT (Flattened Image Tree) image verification mechan
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same br
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 fi
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today