New U-Boot flaws expose early-boot attack surface
New U-Boot flaws expose early-boot attack surface
Six vulnerabilities in the widely used bootloader U-Boot were disclosed by Binarly, including two that may allow arbitrary code execution during FIT signature verification and four that can crash devices. The affected code reportedly dates back to version 2013.07 and may impact more than 50 releases plus downstream vendor forks.
The issue is operationally significant because compromise at the bootloader stage occurs before the OS and its security tooling start. Systems using remote firmware update paths, including some BMC environments, expand the exposure, while remediation depends on vendor firmware updates rather than upstream fixes alone.
️ Open sources - closed narratives
Source: Telegram "sitreports"