barebox Denial-of-Service Vulnerability in ext4 Directory Parsing

A denial-of-service vulnerability has been identified in barebox versions prior to 2026.04.0. The issue arises in the ext4 directory parsing within the file system code, specifically in the ext4fs_iterate_dir() function. This function does not properly validate the length of directory entries, allowing attackers to create a malicious ext4 filesystem image with a directory entry that has a zero-length value. When this crafted image is processed, it causes an infinite loop during directory listing or path resolution, effectively hanging the boot process indefinitely.

Impact

Exploitation of this vulnerability leads to an infinite loop, causing the boot process to hang indefinitely.

Remediation

Users can upgrade to barebox version 2026.04.0 or later to address this vulnerability.