Shahriyar Jalayeri

The MQTT client in the lwIP TCP/IP Stack contains an out-of-bounds write flaw. This issue allows an unauthenticated attacker to achieve remote code execution on the device, potentially enabling lateral movement across industrial networks where unencrypted industrial protocols are used.

An out-of-bounds write occurs in the ` net defragment()` function within net/net.c when `CONFIG IP DEFRAG` is enabled. Remote attackers can trigger this by sending a crafted IP fragment with a non-zero offset and the More-Fragments flag set during netboot, leading to adjacent memory corruption and a bootloader crash.

An out-of-bounds write exists in the RLE8 bitmap decoder within the video subsystem. The `video display rle8 bitmap()` function in `drivers/video/video bmp.c` decodes run-length encoded streams directly into the active framebuffer without validating stream bounds against the frame boundary or allocated buffer size. Because boot splash screens are often rendered from unsigned, user-writable storage before signature verification routines like Android Verified Boot (AVB) or FIT image signature verification are executed, an attacker can provide a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer. This can lead to the corruption of bootloader data structures, function pointers, or verification flags, allowing for a pre-authentication Secure Boot bypass and bootloader crash.

An integer overflow occurs in the `sqfs read directory table()` function during the allocation of the directory table buffer. A remote attacker can provide a specially crafted SquashFS image containing a controlled `metablks count` value in the superblock. This leads to a heap buffer under-allocation and subsequent out-of-bounds writes, which corrupts heap memory and causes the bootloader to crash.

An out-of-bounds write occurs in the `read slotted partition()` function because the software fails to validate the image size against partition bounds. Attackers with physical access can use crafted boot media with oversized headers to write beyond the load buffer into bootloader memory on devices that lack Android Verified Boot protection.

A buffer overflow exists in the `nfs readlink reply()` function within net/nfs-common.c during the processing of NFS server responses. A malicious NFS server can trigger this by sending crafted READLINK replies containing negative or oversized symlink length values, leading to memory corruption and a bootloader crash.

A use-after-free issue exists in the lwIP wget implementation. In the `httpc recv cb()` function, when HTTP data storage fails, the callback frees the connection PCB (Protocol Control Block) but returns `ERR BUF` instead of `ERR ABRT`. This leads the TCP input path to access memory that has already been released, resulting in a bootloader crash.

An out-of-bounds memory access exists in the `dhcp6 parse options()` function. The issue occurs because the system fails to validate the lengths of the `SERVERID` and `CLIENTID` options within DHCPv6 packets. An attacker on the local network can exploit this by sending specially crafted DHCPv6 ADVERTISE or REPLY packets during the netboot process to corrupt memory and cause the bootloader to crash.

A buffer overflow exists in the `nfs read reply()` function within the net/nfs-common.c file. A malicious NFS server can exploit signed integer handling to bypass length validation by providing crafted NFS READ reply lengths. This allows the attacker to write data far beyond the destination buffer, which can lead to memory corruption or a bootloader crash.

The issue allows remote attackers to execute arbitrary code via a long `ImageURL` property, and possibly the `Mode`, `Page`, or `Zoom` properties. This is due to a buffer overflow in the DjVu ActiveX Control.