CVE-2020-10648

CVE-2020-10648 affects Das U-Boot up to version 2020.01, where an attacker could bypass verified boot restrictions and boot arbitrary images by supplying a crafted FIT image to a system configured to boot the default configuration. Connected advisories indicate this CVE is addressed in SUSE secur...

CVE-2019-13103

CVE-2019-13103 describes a vulnerability in Das U-Boot where a crafted self-referential DOS partition table can trigger infinite recursion, causing unbounded stack growth and potentially crashing or corrupting data. Affected: Das U-Boot versions up to 2019.07-rc4. The Connected documents confirm ...

CVE-2022-34835

CVE-2022-34835 affects U-Boot up to 2022.07-rc5, where an integer signedness error in the i2c md command can overflow a stack buffer and corrupt the return address pointer in do_i2c_md. This vulnerability could enable tampering with control flow; exploitation details are not provided in the conne...

CVE-2017-3225

CVE-2017-3225 concerns Das U-Boot, a device bootloader that reads configuration from an AES-CBC encrypted file. The vulnerability stems from U-Boot using a zero initialization vector (IV) in AES-CBC, which enables dictionary-like attacks on encrypted data to learn information about the ciphertext...

CVE-2018-18439

DENX U-Boot (through 2018.09-rc1) is affected by CVE-2018-18439 due to a remotely exploitable buffer overflow in TFTP handling and an additional local exploit path via a crafted kernel image. The vulnerability enables network-triggered overflow via a malicious TFTP server and also allows local ex...

CVE-2017-3226

CVE-2017-3226 concerns Das U-Boot’s AES-CBC environment encryption (CONFIG_ENV_AES=y). A crafted two‑byte sequence in the encrypted environment data can trigger an error during environment variable parsing, which is improperly handled and leads to an immediate process termination with a debugging...

CVE-2025-24857

The vulnerability CVE-2025-24857 affects Universal Boot Loader (U-Boot) versions prior to 2017.11 and certain Qualcomm boot ROM/SoC families (IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, IPQ9574). The root cause is improper access control for volatile memory containing boot code, which c...

CVE-2026-29009

U-Boot (through 2026.04-rc3) contains a buffer overflow in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled. An attacker-controlled NFS server can send multiple relative symlink targets to overflow the 2048-byte nfs_path_buff, potentially corrupting adjacent BSS variables (n...

CVE-2026-29007

CVE-2026-29007 affects U-Boot (versions up to 2026.04-rc3) with CONFIG_PROT_TCP enabled. The issue is an out-of-bounds read in tcp_rx_state_machine() (net/tcp.c) triggered by a crafted IP packet whose total length and TCP data offset fields are mismatched, e.g., IP length 40 bytes and TCP header ...

CVE-2026-29008

U-Boot 2026.04-rc3 contains a vulnerability in tcp_rx_state_machine() (net/tcp.c) that can crash the bootloader via a malformed TCP SYN+ACK with manipulated data offset, causing payload_len to become negative. The negative value is implicitly converted to a large unsigned integer and passed to me...