PT-2025-6744 · Unknown+4 · Das U-Boot+4

David Gstir + 1 · Published 2025-02-17 · Updated 2026-02-23 · CVE-2024-57258

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DAS U-Boot versions prior to 2025.01-RC1

Description Integer overflows in memory allocation occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff t is mishandled on x86 64. This issue affects the memory allocation in DAS U-Boot.

Recommendations For versions prior to 2025.01-RC1, update to version 2025.01-RC1 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted squashfs filesystems to minimize the risk of exploitation. Avoid using the sbrk and request2size functions with untrusted input until the issue is resolved.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BDU:2025-02558

CVE-2024-57258

DLA-4150-1

OESA-2025-1210

OESA-2025-1211

OESA-2025-1212

OESA-2025-1213

OESA-2025-1214

OPENSUSE-SU-2025_0755-1

OPENSUSE-SU-2025_0763-1

OPENSUSE-SU-2025_0817-1

OPENSUSE-SU-2025_0989-1

SUSE-SU-2025:0755-1

SUSE-SU-2025:0763-1

SUSE-SU-2025:0817-1

SUSE-SU-2025:0989-1

SUSE-SU-2025:20219-1

USN-8056-1

Affected Products

Das U-Boot

Debian

Linuxmint

Suse

Ubuntu

References · 58

• https://nvd.nist.gov/vuln/detail/CVE-2024-57257 · Security Note
• https://source.denx.de/u-boot/u-boot/-/commit/c17b2a05dd50a3ba437e6373093a0d6a359cdee0 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-57258 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57259 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:0755-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-57258 · Security Note
• https://ubuntu.com/security/CVE-2024-57259 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1210 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02558 · Security Note
• https://source.denx.de/u-boot/u-boot/-/commit/0a10b49206a29b4aa2f80233a3e53ca0466bb0b3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-57255 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-57258 · Security Note
• https://osv.dev/vulnerability/USN-8056-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1214 · Vendor Advisory