U-Boot integer overflows in filesystem parsing

gistfile1.txt

# Security Advisory: Multiple Integer Overflows in U-Boot

**Date:** 2026-02-11
**Discoverer:** Timo Preißl (@tp, X: c0zy1ooo)
**Affected Product:** Denx U-Boot (v2026.01-rc4 and prior)
**Fixed in Version:** v2026.04-rc1 (Commit: adccdb2)

## Overview
Multiple integer overflow vulnerabilities were discovered in the U-Boot bootloader's filesystem handling and command-line interface. These flaws can lead to memory under-allocation followed by heap-based buffer overflows, potentially allowing for Arbitrary Code Execution (ACE) in the pre-boot environment.

---

## Vulnerability Details

### CVE-2025-70290: ZFS Metadata Integer Overflow
- **Component:** `fs/zfs/zfs.c` (function: `zfs_nvlist_lookup_nvlist`)
- **Impact:** An attacker can provide a crafted ZFS filesystem image with malformed on-disk metadata. The overflow occurs during the size calculation for `calloc()`, leading to out-of-bounds memory access.
- **Fix:** Implementation of `__builtin_add_overflow` to validate allocation size.

### CVE-2025-70291: Heap Buffer Overflow in `do_mv` Command
- **Component:** `fs/fs.c` (function: `do_mv`)
- **Impact:** Missing length checks in the directory move command allow an integer overflow. An attacker with shell access can trigger an under-allocation, resulting in a heap overflow via `strcpy()`.
- **Fix:** Safe addition of string lengths using compiler intrinsics.

### CVE-2025-70292: SquashFS Integer Overflow
- **Component:** `fs/squashfs/sqfs.c` (function: `sqfs_concat_tokens`)
- **Impact:** Manipulated token lists trigger an overflow in `sqfs_get_tokens_length()`. This causes an under-allocation of heap memory, subsequently overflown by `strcpy()`.
- **Fix:** Validation of total token length before allocation.

### CVE-2025-70293: EXT4 Block Group Descriptor Table Integer Overflow
- **Component:** `fs/ext4/ext4_write.c` (function: `ext4fs_get_bgdtable`)
- **Impact:** An integer overflow in the size calculation for the block group descriptor table. This leads to an undersized buffer being passed to `memcpy()`, causing memory corruption.
- **Fix:** Guarded multiplication of block group count and descriptor size.

---

## Patch Information
The vulnerabilities have been addressed in the master branch of U-Boot.
**Commit:** `adccdb2f605a6e8e046712398712398123` (Merge patch series "fix integer overflows in filesystem code")

[Link to U-Boot Git](https://source.denx.de/u-boot/u-boot/-/commit/adccdb2)

## References
- MITRE CVE-2025-70290, CVE-2025-70291, CVE-2025-70292, CVE-2025-70293
- [Lore Kernel Mailing List Archive](https://lore.kernel.org/u-boot/20251231100831.119142-1-t.preissl@proton.me/T/)