Barebox
Monthly
Memory corruption in the barebox bootloader's EFI PE loader (efi/loader/pe.c) affects all versions prior to 2026.04.0, allowing an attacker who can supply a malicious EFI PE binary to trigger a heap buffer overflow or heap out-of-bounds read and potentially execute code in bootloader context. The flaw stems from a 32-bit integer overflow when computing the virtual image size and from missing bounds validation during PE section copy. No public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), consistent with CISA SSVC rating exploitation as 'none', though the technical impact is rated total. Reported by VulnCheck; a vendor patch is available.
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same broadcast domain crash the device by sending a crafted DHCP Offer or ACK packet that omits the 0xff end marker, triggering an out-of-bounds read in the dhcp_message_type() option parser. Exploitation is unauthenticated but requires adjacent network access, and impact is limited to availability (a crash) rather than code execution or data theft. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.01%, 1st percentile).
A signature bypass vulnerability exists in the barebox bootloader's FIT (Flattened Image Tree) image verification mechanism. The hashed-nodes property, which lists which FIT nodes were signed, is not itself part of the cryptographic hash, allowing an attacker with high privileges and local access to modify this property and trick the bootloader into loading malicious images that were never signed. This affects barebox versions 2016.03.0 through 2025.09.2 and 2025.10.0 through 2026.03.0, with patches available in versions 2025.09.3 and 2026.03.1.
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesystem image to permanently hang the boot process of affected embedded devices. Versions prior to 2026.04.0 are affected via CWE-835 (unreachable loop exit) in ext4fs_iterate_dir() when it encounters a directory entry with a direntlen of zero. No public exploit has been identified and CISA has not added this to KEV; however, the impact of a permanently hung bootloader is a complete availability loss for the affected device.
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 filesystem image - via USB, SD card, or network boot - to crash the bootloader during startup, preventing a device from completing its boot sequence. All barebox versions prior to v2026.04.0 fail to validate the `eh_entries` field in ext4 extent headers against actual buffer capacity in `fs/ext4/ext4_common.c`, enabling heap out-of-bounds reads that can additionally redirect parsing to arbitrary disk offsets. No public exploit has been identified at time of analysis; EPSS (0.01%, 2nd percentile) and SSVC (exploitation: none, automatable: no) both confirm low near-term exploitation probability, though the physical-media attack surface makes this relevant to embedded device supply chain and physical security programs.
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an incoming network packet is directly used as a length field without any bounds. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Memory corruption in the barebox bootloader's EFI PE loader (efi/loader/pe.c) affects all versions prior to 2026.04.0, allowing an attacker who can supply a malicious EFI PE binary to trigger a heap buffer overflow or heap out-of-bounds read and potentially execute code in bootloader context. The flaw stems from a 32-bit integer overflow when computing the virtual image size and from missing bounds validation during PE section copy. No public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), consistent with CISA SSVC rating exploitation as 'none', though the technical impact is rated total. Reported by VulnCheck; a vendor patch is available.
Denial of service in the barebox bootloader (all versions up to and including 2026.04.0) lets an attacker on the same broadcast domain crash the device by sending a crafted DHCP Offer or ACK packet that omits the 0xff end marker, triggering an out-of-bounds read in the dhcp_message_type() option parser. Exploitation is unauthenticated but requires adjacent network access, and impact is limited to availability (a crash) rather than code execution or data theft. No public exploit is identified at time of analysis and the EPSS probability is negligible (0.01%, 1st percentile).
A signature bypass vulnerability exists in the barebox bootloader's FIT (Flattened Image Tree) image verification mechanism. The hashed-nodes property, which lists which FIT nodes were signed, is not itself part of the cryptographic hash, allowing an attacker with high privileges and local access to modify this property and trick the bootloader into loading malicious images that were never signed. This affects barebox versions 2016.03.0 through 2025.09.2 and 2025.10.0 through 2026.03.0, with patches available in versions 2025.09.3 and 2026.03.1.
Infinite loop denial-of-service in barebox's ext4 directory parser allows an attacker who can supply a crafted filesystem image to permanently hang the boot process of affected embedded devices. Versions prior to 2026.04.0 are affected via CWE-835 (unreachable loop exit) in ext4fs_iterate_dir() when it encounters a directory entry with a direntlen of zero. No public exploit has been identified and CISA has not added this to KEV; however, the impact of a permanently hung bootloader is a complete availability loss for the affected device.
Out-of-bounds read vulnerabilities in barebox's ext4 extent parsing allow an attacker who can supply a malformed ext4 filesystem image - via USB, SD card, or network boot - to crash the bootloader during startup, preventing a device from completing its boot sequence. All barebox versions prior to v2026.04.0 fail to validate the `eh_entries` field in ext4 extent headers against actual buffer capacity in `fs/ext4/ext4_common.c`, enabling heap out-of-bounds reads that can additionally redirect parsing to arbitrary disk offsets. No public exploit has been identified at time of analysis; EPSS (0.01%, 2nd percentile) and SSVC (exploitation: none, automatable: no) both confirm low near-term exploitation probability, though the physical-media attack surface makes this relevant to embedded device supply chain and physical security programs.
common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a field of an incoming network packet is directly used as a length field without any bounds. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_req in fs/nfs.c because a length field is directly used for a memcpy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because a length field is directly used for a memcpy. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.