CVE-2024-57258

Published Feb 18, 2025

Last updated 6 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-57258 refers to integer overflow vulnerabilities within the memory allocation function of Das U-Boot (Universal Boot Loader) discovered in versions prior to 2025.01. These vulnerabilities affect the squashfs filesystem, specifically on x86_64 systems. Das U-Boot is a widely used open-source boot loader for embedded systems, enabling these systems to load and execute operating systems. The integer overflows occur during memory allocation, potentially leading to unexpected behavior or system crashes.

Description: Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.
Source: cve@mitre.org
NVD status: Modified
Products: u-boot

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-190

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C7E76777-0A80-4761-954F-AC5D11A1AD86",
            "versionEndIncluding": "2024.10",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.