Barebox 安全漏洞

Barebox is a versatile and flexible bootloader from the Barebox open source. A security vulnerability exists in Barebox versions prior to 2025.01.0, which stems from an integer overflow in dlmalloc.c. The vulnerability is caused by an integer overflow in the dlmalloc.c file...

CVE-2024-57261

In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258...

CVE-2024-57262

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

CVE-2024-57262

CVE-2024-57262 affects barebox prior to 2025.01.0. The flaw is in ext4fs_read_symlink, where a zalloc overflow (adding one to an le32) on a crafted ext4 filesystem with inode size 0xffffffff causes a malloc(0) and a subsequent memory overwrite. This yields a high-severity impact (memory corruptio...

CVE-2024-57262

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

CVE-2024-57261

Technical details for CVE-2024-57261 are not provided in the supplied documents. Please monitor for updates from official advisories.

CVE-2024-57261

In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258...

CVE-2024-57261

In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258...

CVE-2024-57262: Integer Overflow or Wraparound

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

CVE-2024-57262

In barebox before 2025.01.0, ext4fsreadsymlink has an integer overflow for zalloc adding one to an le32 variable via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256...

CVE-2024-57261: Integer Overflow or Wraparound

In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258...

CVE-2024-57261

In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE-2024-57258...

CVE-2024-57260

Multiple vulnerabilities in Barebox’s SquashFS due to missing patches from Linux...

PT-2025-6746

Name of the Vulnerable Software and Affected Versions Barebox versions prior to 2025.01.0 Description The issue concerns a local privilege escalation in SquashFS. Recommendations For versions prior to 2025.01.0, update to version 2025.01.0 or later to resolve the issue...

PT-2025-6748 · Barebox · Barebox

Name of the Vulnerable Software and Affected Versions: barebox versions prior to 2025.01.0 Description: The issue is related to an integer overflow in the ext4fs read symlink function when handling a crafted ext4 filesystem with an inode size of 0xffffffff. This results in a malloc of zero and a...

PT-2025-6747 · Barebox · Barebox

Name of the Vulnerable Software and Affected Versions: barebox versions prior to 2025.01.0 Description: The issue is related to an integer overflow in the request2size function in common/dlmalloc.c. Recommendations: For versions prior to 2025.01.0, update to version 2025.01.0 or later to resolve...

CVE-2021-37847

crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification...

CVE-2021-37848

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison...

CVE-2021-37847

crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used during digest verification...

CVE-2021-37848

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison...