CVE-2024-57256

Name of the Vulnerable Software and Affected Versions Das U-Boot versions prior to 2025.01-rc1

Description An integer overflow occurs in the ext4fs read symlink function in Das U-Boot. This happens when a crafted ext4 filesystem with an inode size of 0xffffffff is used, causing a malloc of zero and resultant memory overwrite. The issue arises from adding one to an LE32 variable in the zalloc function.

Recommendations For versions prior to 2025.01-rc1, update to version 2025.01-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of crafted ext4 filesystems to minimize the risk of exploitation. Avoid using the zalloc function with untrusted input until the issue is resolved.