PT-2026-26702 · Barebox · Barebox

Ahmad Fatoum + 1 · Publicado 2026-03-20 · Atualizado 2026-05-16 · CVE-2026-33243

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions barebox versions 2016.03.0 through 2025.09.2 barebox versions 2025.10.0 through 2026.03.0

Description barebox is a bootloader. When creating a FIT (Firmware Image Table), the mkimage(1) function sets the hashed-nodes property of the FIT signature node. This property lists the nodes of the FIT that were hashed during the signing process for later verification by the bootloader. However, the hashed-nodes property itself is not included in the hash, allowing an attacker to modify it. This modification can potentially trick the bootloader into booting images that have not been verified.

Recommendations Update to barebox version 2025.09.3 or later. Update to barebox version 2026.03.1 or later.

Exploit

Correção

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

CVE-2026-33243

GHSA-3FVJ-Q26P-J6H4

OESA-2026-1834

Produtos afetados

Barebox

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33243.json · Exploit
• https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4 · Aviso do Fabricante
• https://github.com/barebox/barebox/commit/aca01795056d51060cb096f9a1ea309361743e05 · Correção
• https://osv.dev/vulnerability/CVE-2026-33243 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33243 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2035262124524458041 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-33243 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33243 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2035133845436342572 · Publicação no Twitter
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1834 · Nota
• https://osv.dev/vulnerability/OESA-2026-1834 · Aviso do Fabricante
• https://twitter.com/rhmi_fii/status/2055791796324835835 · Publicação no Twitter