CVE-2019-13103 Denial of service in n/a

High 7.1 Published 29 Jul 2019 Updated 12 May 2026

A crafted DOS partition table causes infinite recursion in U-Boot, leading to stack overflow and system crash or data corruption.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2019-13103?

CVE-2019-13103 is a high-severity denial of service vulnerability in n/a, published on 29 Jul 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.

Weakness: CWE-674

Which versions are affected by CVE-2019-13103?

It affects 1 product.

Products include Denx U-Boot.

How do I fix CVE-2019-13103?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-13103 being exploited?

There is no known exploitation of CVE-2019-13103 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2019-13103, GHSA-wfjv-jm8j-274f, UBUNTU-CVE-2019-13103.