Unpatched Critical Flaws Disclosed in U-Boot Bootloader for Embedded Devices

Cybersecurity researchers have disclosed two unpatched security
vulnerabilities^[1]
in the open-source U-Boot boot loader.

The issues, which were uncovered in the IP defragmentation^[2]
algorithm implemented in U-Boot by NCC Group, could be abused to
achieve arbitrary out-of-bounds write and denial-of-service
(DoS).

U-Boot is a boot loader^[3]
used in Linux-based embedded systems such as ChromeOS as well as
ebook readers such as Amazon Kindle and Kobo eReader.

The issues are summarized below –

• CVE-2022-30790 (CVSS score: 9.6) – Hole
  Descriptor overwrite in U-Boot IP packet defragmentation leads to
  an arbitrary out-of-bounds write primitive.
• CVE-2022-30552 (CVSS score: 7.1) – Large
  buffer overflow leads to DoS in U-Boot IP packet defragmentation
  code

It’s worth noting that both the flaws are exploitable only from
the local network. But doing so can enable an attacker to root the
devices and lead to a DoS by crafting a malformed packet.

The shortcomings are expected to be addressed by U-boot
maintainers in an upcoming patch, following which users are
recommended to update to the latest
version^[4].