CVE-2024-57255

Name of the Vulnerable Software and Affected Versions DAS U-Boot versions prior to 2025.01-RC1

Description An integer overflow occurs in the sqfs resolve symlink function in DAS U-Boot through a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and a resultant memory overwrite. This issue can be triggered via a manipulated squashfs filesystem.

Recommendations For versions prior to 2025.01-RC1, update to version 2025.01-RC1 or later to resolve the issue. As a temporary workaround, consider restricting access to the sqfs resolve symlink function to minimize the risk of exploitation. Avoid using crafted squashfs filesystems with an inode size of 0xffffffff until the issue is resolved.