Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot

Researchers at Binarly discovered six vulnerabilities in U-Boot, a widely used bootloader for embedded devices, which could allow attackers to crash devices or execute arbitrary code during the boot process. Two of the flaws enable memory corruption that could lead to code execution before OS loading, undermining the device's chain of trust. The vulnerabilities affect U-Boot versions since v2013.07 and are present in numerous vendor firmwares, though no active exploitation has been reported. Fixes have been merged upstream but are not yet available in a stable release, with the next version expected in October.

AI-extracted · verify before operational use