bootloader security

A critical stack-based buffer overflow in Das U-Boot’s NFS reply parsing — tracked as CVE-2019-14200 — exposes a long-standing attack surface for devices that use network boot or NFS-mounted filesystems during early boot, allowing malformed NFS replies to corrupt memory and, in the worst case...

Das U‑Boot contained a subtle but severe UDP‑parsing bug that was disclosed in mid‑2019: an integer underflow in net_process_received_packet that could drive an unbounded memcpy when packet handlers were called, allowing crafted UDP datagrams to overwrite memory and, in the worst case, enable...

An unbounded memcpy in U-Boot’s NFS reply handler left a wide swath of embedded and development hardware exposed to remote memory corruption and — in many realistic configurations — remote code execution during network boot operations, a defect formally tracked as CVE-2019-14198. (nvd.nist.gov)...

An overlooked parsing bug in Das U-Boot’s NFS reply handling — tracked as CVE-2019-14195 — allows an attacker who can control the NFS responses seen by a device to trigger an unbounded memcpy and corrupt U-Boot’s stack or heap, creating a realistic pathway to code execution during early boot...

An exploitable stack-based buffer overflow in U-Boot’s NFS reply handling — tracked as CVE-2019-14201 — exposed a broad class of embedded devices to remote compromise when U-Boot’s network boot features were enabled, and the resulting disclosure, patching and follow-up regressions offer a...

Das U-Boot shipped a high‑severity network‑facing vulnerability—tracked as CVE‑2019‑14202—that left embedded devices and boot‑time network stacks open to a stack‑based buffer overflow in the NFS reply parsing code, and the flaw demanded immediate attention from device vendors, integrators, and...

Das U‑Boot contained a network‑exposed memory‑safety flaw — CVE‑2019‑14197 — that allowed an attacker controlling or impersonating an NFS server to trigger an out‑of‑bounds read inside the NFS reply parser (nfs_read_reply), with real potential to leak sensitive memory and, in certain...