Out-of-bounds write in Universal Boot Loader (U-Boot) - CVE-2019-14196

Vulnerability identifier: #VU64419

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-14196

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within the nfs_lookup_reply() function in net/nfs.c. A remote attacker can create a specially crafted data to the application, trigger an out-of-bounds write and execute arbitrary code on the target system.

Universal Boot Loader (U-Boot)
openEuler
SIMATIC MV540 H
SIMATIC MV540 S
SIMATIC MV550 H
SIMATIC MV550 S
SIMATIC MV560 U
SIMATIC MV560 X
uboot-tools
uboot-tools-debugsource
uboot-images-elf
uboot-tools-debuginfo
uboot-images-armv8
uboot-tools-help

Install updates from vendor's website.

Universal Boot Loader (U-Boot) - update to 2019.10
SIMATIC MV540 H - update to 3.3.4
SIMATIC MV540 S - update to 3.3.4
SIMATIC MV550 H - update to 3.3.4
SIMATIC MV550 S - update to 3.3.4
SIMATIC MV560 U - update to 3.3.4
SIMATIC MV560 X - update to 3.3.4
uboot-tools - update to 2020.07-7
uboot-tools-debugsource - update to 2020.07-7
uboot-images-elf - update to 2020.07-7
uboot-tools-debuginfo - update to 2020.07-7
uboot-images-armv8 - update to 2020.07-7
uboot-tools-help - update to 2020.07-7

• https://blog.semmle.com/uboot-rce-nfs-vulnerability/
• https://gitlab.com/u-boot/u-boot

• Remote code execution in U-Boot
• Multiple vulnerabilities in Siemens SIMATIC MV500 Devices
• openEuler update for uboot-tools