Sascha Hauer

barebox is a bootloader. When creating a FIT (Firmware Image Table), the `mkimage(1)` function sets the `hashed-nodes` property of the FIT signature node. This property lists the nodes of the FIT that were hashed during the signing process for later verification by the bootloader. However, the `hashed-nodes` property itself is not included in the hash, allowing an attacker to modify it. This modification can potentially trick the bootloader into booting images that have not been verified.

The vulnerability is related to the `mwifiex get priv by id()` function in the Linux kernel, which returns a priv pointer corresponding to the `bss num` and `bss type` without checking if the priv is actually in use. This can lead to NULL pointer dereferences further down the call stack. The issue occurs when an Access Point is started with `wpa supplicant` and a specific configuration, causing a kernel NULL pointer dereference at a virtual address.

The issue is related to a remote buffer overflow in the `nfs readlink reply` function located in `net/nfs.c`. This occurs because a length field is directly used for a `memcpy`, which can lead to a buffer overflow.