Xiaomi-C200-Firmware-Analysis

The Scope このリポジトリでは、露出したピン/テストパッドの一般的なセットがなくても、U-Bootとトリックを使って早期ステージでrootを取得し、最終的にファームウェアをダンプする方法を紹介します。 Initial Reconnaissance PCBから明らかな重要な点がいくつかあります。 チップ → T31 Ingenic プロセッサ フラッシュメモリ → SOIC-8 SPI NOR タイプ 可能性のあるUARTテストパッド...

provisioner

Provisioner 개요 Provisioner 는 개발자 중심의 프로비저닝 도우미로, 단일 보드 컴퓨터SBC, 특히 U-Boot 기반 플랫폼을 대상으로 합니다. 다음과 같은 자체 포함 환경을 제공합니다: 원격으로 보드에 접근 부트업초기화 워크플로우 자동화 커널 및 루트 파일시스템 프로비저닝 플래싱 작업 실행 실험실 하드웨어를 안전하게 공유 운영 모델은 의도적으로 단순합니다: 하나의 보드 = 하나의 프로비저너 인스턴스 Provisioner는 하드웨어에 근접하여 실행되며, 안전하고 다중화된 인터페이스를 통해 개발자에게 제어된 원...

chipicopwn

chipicopwn 针对 Google Nest Hub（第 2 代）elaine 的引导程序漏洞利用 要求 Google Nest Hub（第 2 代） Raspberry Pi Pico 带电源的 USB 集线器或 USB Y 型线缆 pico-sdk（安装说明请参阅入门指南） 支持的版本 出厂固件 2020/12 - U-Boot 2019.01-gbfc19012ea-dirty 2020年12月11日 - 04:19:32 出厂固件 2022/01, 2022/02 - U-Boot 2019.01-g9542d3593d-dirty 2021年5月21日 - 20:52:4...

CVE-2025-45512

U-Boot 1.1.3 Exploit PoC 사용 가이드 소개 이 PoCProof of Concept는 2019년 8월 27일에 컴파일된 U-Boot 부트로더 버전 1.1.3의 취약점을 확인하기 위해 제작되었습니다. 이 코드는 OWASP IoT 보안 테스트 가이드ISTG 카테고리와 관련된 5가지 취약점을 구현합니다. 경고: 이 PoC는 테스트 권한이 있는 장치에서만 사용하십시오. 권한 없이 시스템에 사용하면 관련 법률을 위반할 수 있습니다. 요구사항 1. Python 3.6+ 2. 직렬 인터페이스UART를 통한 대상 장치의 물...

Linux Distros Unpatched Vulnerability : CVE-2026-71974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds...

Linux Distros Unpatched Vulnerability : CVE-2026-71972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the videodisplayrle8bitmap function in drivers/video/videobmp.c. Attackers can suppl...

Linux Distros Unpatched Vulnerability : CVE-2026-74222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails,...

Linux Distros Unpatched Vulnerability : CVE-2026-71971

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - U-Boot before 2026.10-rc3 with CONFIGIPDEFRAG enabled contains an out-of-bounds write vulnerability in the netdefragment function in net/net.c. Remote attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-71973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers ca...

SUSE CVE-2026-74220

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

SUSE CVE-2026-74221

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadlinkreply function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader...

SUSE CVE-2026-74222

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...

CVE-2026-71974

A flaw was found in U-Boot. The bootloader fails to properly validate image sizes against partition boundaries when reading Android boot partitions. An attacker with physical access to the device can exploit this vulnerability by connecting crafted boot media with oversized headers, causing an...

EUVD-2026-89436

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6parseoptions that fails to validate SERVERID and CLIENTID option lengths from DHCPv6 packets. Attackers on the local network can send crafted DHCPv6 ADVERTISE or REPLY packets during netboot to corrupt memory and crash the...

EUVD-2026-89434

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadlinkreply function in net/nfs-common.c when processing NFS server responses. A malicious NFS server can send crafted READLINK replies with negative or oversized symlink length values to corrupt memory and crash the bootloader...

EUVD-2026-89432

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in readslottedpartition that fails to validate image size against partition bounds. Attackers with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on...

EUVD-2026-89433

U-Boot before 2026.10-rc5 contains a buffer overflow in nfsreadreply function in net/nfs-common.c that allows attackers to corrupt memory by supplying crafted NFS READ reply lengths. A malicious NFS server can exploit signed integer handling to bypass length validation and write far past the...

EUVD-2026-89435

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpcrecvcb function within the lwIP wget implementation. When HTTP data storage fails, the callback frees the connection PCB but returns ERRBUF instead of ERRABRT, causing the TCP input path to access released memory and...

EUVD-2026-89431

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfsreaddirectorytable function when allocating the directory table buffer. Attackers can supply a crafted SquashFS image with an attacker-controlled superblock metablkscount value that causes heap buffer under-allocation and...

EUVD-2026-89430

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the videodisplayrle8bitmap function in drivers/video/videobmp.c. Attackers can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader...