CVE-2024-57256

Summary

CVE-2024-57256 is a newly disclosed vulnerability affecting Das U-Boot before version 2025.01-rc1. This issue stems from an integer overflow in the function ext4fs_read_symlink. A specially crafted ext4 filesystem with an inline size of 0xffffffff can lead to a zalloc operation adding one to an le32 variable, causing it to wrap around and result in a malloc request of zero. The subsequent memory overwrite can lead to potential code injection or other unintended behavior.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.