barebox Out-of-Bounds Read Vulnerability in ext4 Parsing

A heap-based out-of-bounds read vulnerability has been identified in barebox versions prior to 2026.04.0. This issue arises in the ext4 extent parsing within the file 'fs/ext4/ext4_common.c', where the 'eh_entries' field is not properly validated against the buffer capacity. As a result, attackers can exploit this vulnerability by supplying a malicious ext4 filesystem image through USB, SD card, or network boot. The exploitation occurs during the boot-time filesystem parsing, potentially allowing arbitrary reads from the disk.

Impact

Exploitation of this vulnerability leads to heap out-of-bounds reads, which can be manipulated to redirect memory reads to arbitrary disk offsets.

Remediation

Users can upgrade to barebox version 2026.04.0 or later to address this vulnerability.