13 vulnerabilities disclosed in U-Boot loader

guest · Jul 24, 2019

13 vulnerabilities disclosed in U-Boot loader
July 24, 2019
https://www.scmagazine.com/home/sec...3-vulnerabilities-disclosed-in-u-boot-loader/

The code analysis platform provider Semmle has publicly disclosed 13 vulnerabilities in the open-source universal boot loader Das U-Boot
The issues, which can lead to remote code execution, are exploitable when U-Boot is configured to use networking and NFS, said Semmle CSO Fermín Serna, who discovered the fault.

“Through these vulnerabilities, an attacker in the same network (or controlling a malicious NFS server) could execute code on the U-Boot powered device. Due to the nature of this vulnerability, exploitation does not seem extremely complicated, although it could be made more challenging by using stack cookies, ASLR, or other memory protection runtime and compile time mitigations,” Serna said.

The issue was discovered on May 15, 2019. Semmle contacted U-Boot maintainers on May 23 after the investigation concluded and received a confirmation from Rini the following day. Public disclosure took place on July 22.
Click to expand...

U-Boot RCE Vulnerabilities Affecting IoT Devices

Log in or Sign up

13 vulnerabilities disclosed in U-Boot loader

guest Guest

Log in or Sign up

13 vulnerabilities disclosed in U-Boot loader

guest Guest

Useful Searches