Das U-Boot Stack Consumption Vulnerability via Deeply Nested Symlinks in SquashFS Filesystems

A stack consumption vulnerability has been identified in Das U-Boot bootloader versions through 2024.10. The issue arises in the 'sqfs_size' function, where the bootloader improperly handles deeply nested symlinks within a crafted SquashFS filesystem. This flaw can lead to excessive stack usage, potentially causing a stack overflow.

Impact

Exploitation of this vulnerability causes excessive stack consumption, which can lead to a stack overflow, a common type of buffer overflow where the stack memory is overrun, potentially allowing for arbitrary code execution or causing the system to crash.

Remediation

Users are advised to upgrade to U-Boot version 2025.01-rc1 or later.