CVE-2024-57254

Published Feb 18, 2025

Last updated 6 months ago

Ubuntu

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-57254 is an integer overflow vulnerability found in Das U-Boot (Universal Boot Loader) prior to version 2025.01-rc1. The vulnerability exists in the `sqfs_inode_size` function during the calculation of symlink size. Specifically, it can be triggered by a specially crafted SquashFS filesystem, potentially leading to further vulnerabilities, especially if the size calculation is used for resource management or execution control. Das U-Boot is a widely used boot loader in embedded systems, often used to initialize hardware and load the operating system. A SquashFS filesystem is a compressed read-only filesystem commonly used in embedded systems due to its small size. Exploiting this vulnerability requires local access. Upgrading to Das U-Boot version 2025.01-rc1 or later mitigates this vulnerability.

Description: An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem.
Source: cve@mitre.org
NVD status: Modified
Products: u-boot

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.8
Impact score: 5.9
Exploitability score: 0.9
Vector string: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: MEDIUM

Weaknesses

cve@mitre.org: CWE-190

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C7E76777-0A80-4761-954F-AC5D11A1AD86",
            "versionEndIncluding": "2024.10",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.