CVE-2024-57262 Integer overflow in barebox
An integer overflow in barebox allows attackers to cause memory corruption and potentially execute code via a crafted ext4 filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-57262?
CVE-2024-57262 is a high-severity vulnerability in Pengutronix barebox, published on 19 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In barebox before 2025.01.0, ext4fs_read_symlink has an integer overflow for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256.
Weakness: CWE-190
Which versions are affected by CVE-2024-57262?
How do I fix CVE-2024-57262?
No fix has been published for CVE-2024-57262 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-57262 being exploited?
There is no known exploitation of CVE-2024-57262 in the wild and no public exploit code.
Sources
Also known as GHSA-5v3r-5x6q-8vmg.