Das U-Boot Heap Corruption Vulnerability in SquashFS Directory Listing

A heap memory corruption vulnerability has been identified in Das U-Boot versions prior to 2025.01-rc1. This issue arises in the 'sqfs_search_dir' function, which handles SquashFS directory listings. The vulnerability is caused by an off-by-one error that leads to improper size calculations, as the path separator is not adequately considered. An attacker capable of modifying SquashFS filesystem data structures can exploit this vulnerability.

Impact

Exploitation of this vulnerability leads to heap memory corruption, which can be manipulated to execute arbitrary code.

Remediation

Users are advised to upgrade to U-Boot version 2025.01-rc1 or newer.