U-Boot integer overflow in ZFS/Ext4/SquashFS (CVE-2025-70290-70293)

Summary of U-Boot Integer Overflow Vulnerabilities Vulnerability Overview The U-Boot bootloader is affected by multiple integer overflow vulnerabilities in filesystem processing and command-line parsing. These issues, discovered by Timo Presli, affect version V2026.04-rc4 and earlier, and have been fixed in V2026.04-rc1 (Commit: a0c0b2). Scope of Impact CVE-2025-70290: Integer Overflow in ZFS Metadata - Component: (Function: ) - Impact: An attacker can craft a ZFS filesystem image with corrupted on-disk metadata, triggering an overflow when verifying allocation size in . - Fix: Verify allocation size using . CVE-2025-70291: Heap Buffer Overflow ( command) - Component: (Function: ) - Impact: Missing length checks in directory commands may lead to integer overflow. - Fix: Safely add string length checks in the command. CVE-2025-70292: Integer Overflow in Squashfs - Component: (Function: ) - Impact: The token count calculation in can be triggered by manipulated token counts, causing an underflow in heap allocation size calculation. - Fix: Verify the token count calculation. CVE-2025-70293: Integer Overflow in Ext4 Block Group Descriptor Table - Component: (Function: ) - Impact: Integer overflow in the block group descriptor table size calculation, leading to underflow. - Fix: Guard the multiplication of the block group count and descriptor size. Remediation Patch Details: The vulnerabilities have been fixed in the U-Boot main branch. Commit: ("Merge pull series 'fix integer overflows in filesystem code'") Link: https://source.denx.com/web/u-boot/commit/0c0c2f References MITRE CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293 LKML Mailing List Archive: https://lore.kernel.org/u-boot/20251231100821.119542-1-t.prest@denx.com/ POC/Exploit Code No POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

U-Boot integer overflow in ZFS/Ext4/SquashFS (CVE-2025-70290-70293)