PT-2025-6744 · Unknown+4 · Das U-Boot+4

David Gstir + 1 · Publicado 2025-02-17 · Atualizado 2026-02-23 · CVE-2024-57258

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DAS U-Boot versions prior to 2025.01-RC1

Description Integer overflows in memory allocation occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff t is mishandled on x86 64. This issue affects the memory allocation in DAS U-Boot.

Recommendations For versions prior to 2025.01-RC1, update to version 2025.01-RC1 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted squashfs filesystems to minimize the risk of exploitation. Avoid using the sbrk and request2size functions with untrusted input until the issue is resolved.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

BDU:2025-02558

CVE-2024-57258

DLA-4150-1

OESA-2025-1210

OESA-2025-1211

OESA-2025-1212

OESA-2025-1213

OESA-2025-1214

OPENSUSE-SU-2025_0755-1

OPENSUSE-SU-2025_0763-1

OPENSUSE-SU-2025_0817-1

OPENSUSE-SU-2025_0989-1

SUSE-SU-2025:0755-1

SUSE-SU-2025:0763-1

SUSE-SU-2025:0817-1

SUSE-SU-2025:0989-1

SUSE-SU-2025:20219-1

USN-8056-1

Produtos afetados

Das U-Boot

Debian

Linuxmint

Suse

Ubuntu

Referências · 58

• https://t.me/cvenotify/111702 · Publicação no Telegram
• https://bugzilla.suse.com/1237284 · Nota
• https://openwall.com/lists/oss-security/2025/02/17/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-57257 · Nota de Segurança
• https://source.denx.de/u-boot/u-boot/-/commit/c17b2a05dd50a3ba437e6373093a0d6a359cdee0 · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-57258 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2024-57256 · Nota
• https://osv.dev/vulnerability/OESA-2025-1212 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-57259 · Nota de Segurança
• https://suse.com/support/update/announcement/2025/suse-su-20250755-1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2025:0755-1 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2025/suse-su-20250817-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-57258 · Nota de Segurança
• https://ubuntu.com/security/CVE-2024-57259 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2024-57258 · Nota