Integer overflow in Universal Boot Loader (U-Boot) - CVE-2024-57258

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU105296

Integer overflow in Universal Boot Loader (U-Boot) - CVE-2024-57258

Published: March 4, 2025


Vulnerability identifier: #VU105296
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-57258
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow. A local user can use a specially crafted squashfs filesystem to trigger integer overflow and execute arbitrary code on the target system.


Affected software

Universal Boot Loader (U-Boot)
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
u-boot-xilinxzynqmpgeneric
u-boot-xilinxzynqmpgeneric-doc
uboot-images-elf
uboot-tools-debuginfo
uboot-tools-debugsource
uboot-images-armv8
uboot-tools-help
uboot-tools
u-boot-rpi4-doc
u-boot-rock960-rk3399
u-boot-nanopia64
u-boot-libretech-ac-doc
u-boot-xilinxzynqmpvirt-doc
u-boot-libretech-cc
u-boot-khadas-vim2-doc
u-boot-mvebudb-88f3720-doc
u-boot-xilinxzynqmpvirt
u-boot-poplar
u-boot-ls1012afrdmqspi-doc
u-boot-orangepipc2-doc
u-boot-nanopia64-doc
u-boot-firefly-rk3399-doc
u-boot-pine64plus-doc
u-boot-rock-pi-4-rk3399
u-boot-rock-pi-4-rk3399-doc
u-boot-hikey
u-boot-tools
u-boot-pineh64-doc
u-boot-geekbox
u-boot-tools-debuginfo
u-boot-odroid-c2
u-boot-mvebudbarmada8k
u-boot-poplar-doc
u-boot-rock960-rk3399-doc
u-boot-rpiarm64
u-boot-firefly-rk3399
u-boot-rpi4
u-boot-orangepipc2
u-boot-rock64-rk3328
u-boot-rock64-rk3328-doc
u-boot-p3450-0000
u-boot-avnetultra96rev1-doc
u-boot-rockpro64-rk3399
u-boot-khadas-vim-doc
u-boot-khadas-vim2
u-boot-rpi3-doc
u-boot-rpiarm64-doc
u-boot-p2371-2180
u-boot-hikey-doc
u-boot-mvebuespressobin-88f3720-doc
u-boot-pineh64
u-boot-odroid-n2-doc
u-boot-ls1012afrdmqspi
u-boot-dragonboard820c
u-boot-evb-rk3399-doc
u-boot-p3450-0000-doc
u-boot-pinebook
u-boot-odroid-c4
u-boot-dragonboard410c-doc
u-boot-dragonboard820c-doc
u-boot-odroid-c2-doc
u-boot-p2771-0000-500
u-boot-dragonboard410c
u-boot-khadas-vim
u-boot-odroid-n2
u-boot-pinebook-pro-rk3399-doc
u-boot-xilinxzynqmpzcu102rev10-doc
u-boot-mvebuespressobin-88f3720
u-boot-bananapim64-doc
u-boot-libretech-ac
u-boot-libretech-cc-doc
u-boot-evb-rk3399
u-boot-p2371-2180-doc
u-boot-pinebook-pro-rk3399
u-boot-pinephone
u-boot-rpi3
u-boot-pinebook-doc
u-boot-xilinxzynqmpzcu102rev10
u-boot-rockpro64-rk3399-doc
u-boot-p2771-0000-500-doc
u-boot-mvebumcbin-88f8040-doc
u-boot-mvebumcbin-88f8040
u-boot-mvebudbarmada8k-doc
u-boot-pinephone-doc
u-boot-bananapim64
u-boot-odroid-c4-doc
u-boot-mvebudb-88f3720
u-boot-avnetultra96rev1
u-boot-pine64plus
u-boot-geekbox-doc
u-boot-rock-pi-n10-rk3399pro
u-boot-rock-pi-n10-rk3399pro-doc
u-boot (Ubuntu package)

How to mitigate CVE-2024-57258

Install updates from vendor's website.

Universal Boot Loader (U-Boot) - update to 2025.01 rc1
u-boot-xilinxzynqmpgeneric - update to 2020.01-150200.10.18.1
u-boot-xilinxzynqmpgeneric-doc - update to 2020.01-150200.10.18.1
uboot-images-elf - addressed in versions 2020.07-9, 2021.10-9, 2024.01-2
uboot-tools-debuginfo - addressed in versions 2020.07-9, 2021.10-9, 2024.01-2
uboot-tools-debugsource - addressed in versions 2020.07-9, 2021.10-9, 2024.01-2
uboot-images-armv8 - addressed in versions 2020.07-9, 2021.10-9, 2024.01-2
uboot-tools-help - addressed in versions 2020.07-9, 2021.10-9, 2024.01-2
uboot-tools - addressed in versions 2020.07-9, 2021.10-9, 2024.01-2
u-boot-rpi4-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rock960-rk3399 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-nanopia64 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-libretech-ac-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-xilinxzynqmpvirt-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-libretech-cc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-khadas-vim2-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-mvebudb-88f3720-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-xilinxzynqmpvirt - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-poplar - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-ls1012afrdmqspi-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-orangepipc2-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-nanopia64-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-firefly-rk3399-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pine64plus-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rock-pi-4-rk3399 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rock-pi-4-rk3399-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-hikey - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-tools - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pineh64-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-geekbox - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-tools-debuginfo - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-odroid-c2 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-mvebudbarmada8k - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-poplar-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rock960-rk3399-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rpiarm64 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-firefly-rk3399 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rpi4 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-orangepipc2 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rock64-rk3328 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rock64-rk3328-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-p3450-0000 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-avnetultra96rev1-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rockpro64-rk3399 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-khadas-vim-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-khadas-vim2 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rpi3-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rpiarm64-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-p2371-2180 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-hikey-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-mvebuespressobin-88f3720-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pineh64 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-odroid-n2-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-ls1012afrdmqspi - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-dragonboard820c - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-evb-rk3399-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-p3450-0000-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pinebook - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-odroid-c4 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-dragonboard410c-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-dragonboard820c-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-odroid-c2-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-p2771-0000-500 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-dragonboard410c - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-khadas-vim - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-odroid-n2 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pinebook-pro-rk3399-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-xilinxzynqmpzcu102rev10-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-mvebuespressobin-88f3720 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-bananapim64-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-libretech-ac - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-libretech-cc-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-evb-rk3399 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-p2371-2180-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pinebook-pro-rk3399 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pinephone - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rpi3 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pinebook-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-xilinxzynqmpzcu102rev10 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rockpro64-rk3399-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-p2771-0000-500-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-mvebumcbin-88f8040-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-mvebumcbin-88f8040 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-mvebudbarmada8k-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pinephone-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-bananapim64 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-odroid-c4-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-mvebudb-88f3720 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-avnetultra96rev1 - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-pine64plus - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-geekbox-doc - addressed in versions 2021.01-150300.7.24.1, 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rock-pi-n10-rk3399pro - addressed in versions 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot-rock-pi-n10-rk3399pro-doc - addressed in versions 2021.10-150400.4.14.1, 2021.10-150600.11.3.1
u-boot (Ubuntu package) - addressed in versions 2022.01+dfsg-2ubuntu2.7, 2025.10-0ubuntu0.24.04.2

External References

Related Security Bulletins