{"id":"CVE-2024-57258","aliases":["DEBIAN-CVE-2024-57258","DLA-4150-1","EUVD-2025-4757","GHSA-grrx-h759-85hh","OESA-2025-1210","OESA-2025-1211","OESA-2025-1212","OESA-2025-1213","OESA-2025-1214","SUSE-SU-2025:0755-1","SUSE-SU-2025:0763-1","SUSE-SU-2025:0817-1","SUSE-SU-2025:0989-1","SUSE-SU-2025:20219-1","UBUNTU-CVE-2024-57258","USN-8056-1"],"status":"published","title":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted...","description":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00246,"percentile":0.15977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190"],"published":"2025-02-18T00:00:00Z","modified":"2026-11-02T12:03:10Z","fixes":[{"ecosystem":"Debian:12","package":"u-boot","fixed_in":["2023.01+dfsg-2+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"u-boot","fixed_in":["2025.01-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"u-boot","fixed_in":["2025.01-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"u-boot","fixed_in":["2022.01+dfsg-2ubuntu2.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"u-boot","fixed_in":["2025.10-0ubuntu0.24.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.01+dfsg-2+deb12u2"}]}],"versions":["2023.01+dfsg-2","2023.01+dfsg-2+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.01-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.01-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01+dfsg-5+deb11u1"}]}],"versions":["2021.01+dfsg-5"],"bundled":14},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"uboot-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-9.oe2203sp3"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"uboot-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-9.oe2203sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"uboot-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.01-2.oe2403"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"uboot-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.01-2.oe2403sp1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"uboot-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.07-9.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-xilinxzynqmpgeneric","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.01-150200.10.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150400.4.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.01-150300.7.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-avnetultra96rev1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-bananapim64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-dragonboard410c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-dragonboard820c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-evb-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-firefly-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-geekbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-hikey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-khadas-vim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-khadas-vim2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-libretech-ac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-libretech-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-ls1012afrdmqspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-mvebudb-88f3720","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-mvebudbarmada8k","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-mvebuespressobin-88f3720","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-mvebumcbin-88f8040","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-nanopia64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-odroid-c2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-odroid-c4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-odroid-n2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-orangepipc2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-p2371-2180","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-p2771-0000-500","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-p3450-0000","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-pine64plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-pinebook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-pinebook-pro-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-pineh64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-pinephone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-poplar","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-rock-pi-4-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-rock-pi-n10-rk3399pro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-rock64-rk3328","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-rock960-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-rockpro64-rk3399","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-rpi3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-rpi4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-xilinxzynqmpvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"u-boot-xilinxzynqmpzcu102rev10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.10-150600.11.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"u-boot-rpiarm64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2023.04-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2015.04+dfsg1-2ubuntu1","2015.10+dfsg1-2","2015.10+dfsg1-3","2015.10+dfsg1-4","2016.01+dfsg1-1","2016.01+dfsg1-1ubuntu1","2016.01+dfsg1-2ubuntu1","2016.01+dfsg1-2ubuntu2","2016.01+dfsg1-2ubuntu3","2016.01+dfsg1-2ubuntu5","2016.01+dfsg1-2ubuntu5+esm1","2016.01+dfsg1-2ubuntu5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2016.03+dfsg1-6ubuntu2","2018.07~rc3+dfsg1-0ubuntu1~18.04.1","2018.07~rc3+dfsg1-0ubuntu2~18.04.1","2018.07~rc3+dfsg1-0ubuntu3~18.04.1","2019.07+dfsg-1ubuntu4~18.04.1","2020.10+dfsg-1ubuntu0~18.04.2","2020.10+dfsg-1ubuntu0~18.04.3","2020.10+dfsg-1ubuntu0~18.04.3+esm1","2020.10+dfsg-1ubuntu0~18.04.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2019.07+dfsg-1ubuntu3","2019.07+dfsg-1ubuntu5","2019.07+dfsg-1ubuntu6","2020.10+dfsg-1ubuntu0~20.04.2","2021.01+dfsg-3ubuntu0~20.04.1","2021.01+dfsg-3ubuntu0~20.04.3","2021.01+dfsg-3ubuntu0~20.04.4","2021.01+dfsg-3ubuntu0~20.04.5","2021.01+dfsg-3ubuntu0~20.04.6","2021.01+dfsg-3ubuntu0~20.04.6+esm1","2021.01+dfsg-3ubuntu0~20.04.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.01+dfsg-2ubuntu2.7"}]}],"versions":["2021.07+dfsg-0ubuntu8","2021.07+dfsg-0ubuntu9","2021.07+dfsg-0ubuntu10","2022.01+dfsg-2ubuntu1","2022.01+dfsg-2ubuntu2","2022.01+dfsg-2ubuntu2.1","2022.01+dfsg-2ubuntu2.3","2022.01+dfsg-2ubuntu2.4","2022.01+dfsg-2ubuntu2.5","2022.01+dfsg-2ubuntu2.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"u-boot-nezha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2021.09+git20211008.62392d3-0ubuntu1","2022.04+git20220405.7446a472-0ubuntu0.1","2022.04+git20220405.7446a472-0ubuntu0.2","2022.04+git20220405.7446a472-0ubuntu0.3","2022.04+git20220405.7446a472-0ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu0.24.04.2"}]}],"versions":["2023.07+dfsg-1ubuntu2","2024.01+dfsg-1ubuntu1","2024.01+dfsg-1ubuntu2","2024.01+dfsg-1ubuntu3","2024.01+dfsg-1ubuntu4","2024.01+dfsg-1ubuntu5","2024.01+dfsg-1ubuntu5.1","2024.01+dfsg-1ubuntu5.2","2025.01-0ubuntu0.24.04.1","2025.01-0ubuntu0.24.04.2","2025.10-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"u-boot-nezha","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.10-1089-g528ae9bc6c-0ubuntu2","2024.01~rc1-190-g2e89b706f5-0ubuntu1","2024.01~rc1-190-g2e89b706f5-0ubuntu2","2024.01~rc1-190-g2e89b706f5-0ubuntu2.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.01+dfsg-2ubuntu2.7"}]}],"versions":["2021.07+dfsg-0ubuntu8","2021.07+dfsg-0ubuntu9","2021.07+dfsg-0ubuntu10","2022.01+dfsg-2ubuntu1","2022.01+dfsg-2ubuntu2","2022.01+dfsg-2ubuntu2.1","2022.01+dfsg-2ubuntu2.3","2022.01+dfsg-2ubuntu2.4","2022.01+dfsg-2ubuntu2.5","2022.01+dfsg-2ubuntu2.6"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"u-boot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.10-0ubuntu0.24.04.2"}]}],"versions":["2023.07+dfsg-1ubuntu2","2024.01+dfsg-1ubuntu1","2024.01+dfsg-1ubuntu2","2024.01+dfsg-1ubuntu3","2024.01+dfsg-1ubuntu4","2024.01+dfsg-1ubuntu5","2024.01+dfsg-1ubuntu5.1","2024.01+dfsg-1ubuntu5.2","2025.01-0ubuntu0.24.04.1","2025.01-0ubuntu0.24.04.2","2025.10-0ubuntu0.24.04.1"],"bundled":6}],"products":[{"vendor":"denx","product":"u-boot"},{"vendor":"denx software engineering","product":"u-boot"},{"vendor":"siemens","product":"ruggedcom rox mx5000"},{"vendor":"siemens","product":"ruggedcom rox mx5000re"},{"vendor":"siemens","product":"ruggedcom rox rx1400"},{"vendor":"siemens","product":"ruggedcom rox rx1500"},{"vendor":"siemens","product":"ruggedcom rox rx1501"},{"vendor":"siemens","product":"ruggedcom rox rx1510"},{"vendor":"siemens","product":"ruggedcom rox rx1511"},{"vendor":"siemens","product":"ruggedcom rox rx1512"},{"vendor":"siemens","product":"ruggedcom rox rx1524"},{"vendor":"siemens","product":"ruggedcom rox rx1536"},{"vendor":"siemens","product":"ruggedcom rox rx5000"}],"references":[{"url":"https://source.denx.de/u-boot/u-boot/-/commit/0a10b49206a29b4aa2f80233a3e53ca0466bb0b3","tags":["Patch","web"]},{"url":"https://source.denx.de/u-boot/u-boot/-/commit/8642b2178d2c4002c99a0b69a845a48f2ae2706f","tags":["Patch","web"]},{"url":"https://source.denx.de/u-boot/u-boot/-/commit/c17b2a05dd50a3ba437e6373093a0d6a359cdee0","tags":["Patch","web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/02/17/2","tags":["Mailing List","Mitigation","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00001.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-577017.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57258","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-grrx-h759-85hh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57258.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-57258","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1210","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57256","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57257","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57259","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1211","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1212","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1213","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1214","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250755-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1237284","tags":["report"]},{"url":"https://bugzilla.suse.com/1237287","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57256","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-57258","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250763-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250817-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250989-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520219-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-57258","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-57258","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8056-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-57254","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57255","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57256","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57257","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-57259","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-57258","description":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.","status":"published","published":"2025-02-18T00:00:00Z","modified":"2026-05-12T12:01:27.446Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2025-4757","description":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.","status":"published","published":"2025-02-18T00:00:00Z","modified":"2026-05-12T12:01:27Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:04:38.188393Z"}],"ghsa":[{"id":"GHSA-grrx-h759-85hh","title":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted...","description":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.","status":"published","published":"2025-02-19T00:31:18Z","modified":"2026-05-12T15:30:46Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:08:03.349738Z"}],"nvd":[{"id":"CVE-2024-57258","description":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.","status":"published","published":"2025-02-18T23:15:09.893Z","modified":"2026-06-17T08:13:28.313Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:10:44.508862Z"}],"osv":[{"id":"CVE-2024-57258","description":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.","status":"published","published":"2025-02-18T00:00:00Z","modified":"2026-10-28T02:30:48.025623621Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:44:45.107804Z"},{"id":"DEBIAN-CVE-2024-57258","description":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.","status":"published","published":"2025-02-18T23:15:09.893Z","modified":"2026-11-02T12:03:10.597129986Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"OESA-2025-1210","title":"uboot-tools security update","description":"This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot\u0026amp;apos;s environment.\r\n\r\nSecurity Fix(es):\n\nAn integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem.(CVE-2024-57254)\n\nAn integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57255)\n\nAn integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57256)\n\nA stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.(CVE-2024-57257)\n\nInteger overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.(CVE-2024-57258)\n\nsqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.(CVE-2024-57259)","status":"published","published":"2025-02-28T11:08:18Z","modified":"2026-08-18T01:17:43.86181487Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1211","title":"uboot-tools security update","description":"This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot\u0026amp;apos;s environment.\r\n\r\nSecurity Fix(es):\n\nAn integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem.(CVE-2024-57254)\n\nAn integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57255)\n\nAn integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57256)\n\nA stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.(CVE-2024-57257)\n\nInteger overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.(CVE-2024-57258)\n\nsqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.(CVE-2024-57259)","status":"published","published":"2025-02-28T11:08:18Z","modified":"2026-08-18T01:17:43.871237912Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1212","title":"uboot-tools security update","description":"This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot\u0026amp;apos;s environment.\r\n\r\nSecurity Fix(es):\n\nAn integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem.(CVE-2024-57254)\n\nAn integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57255)\n\nAn integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57256)\n\nA stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.(CVE-2024-57257)\n\nInteger overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.(CVE-2024-57258)\n\nsqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.(CVE-2024-57259)","status":"published","published":"2025-02-28T11:08:18Z","modified":"2026-08-18T01:17:49.144673885Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1213","title":"uboot-tools security update","description":"This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot\u0026amp;apos;s environment.\r\n\r\nSecurity Fix(es):\n\nAn integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem.(CVE-2024-57254)\n\nAn integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57255)\n\nAn integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57256)\n\nA stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting.(CVE-2024-57257)\n\nInteger overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.(CVE-2024-57258)\n\nsqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation.(CVE-2024-57259)","status":"published","published":"2025-02-28T11:08:18Z","modified":"2026-08-18T01:17:49.227502284Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"OESA-2025-1214","title":"uboot-tools security update","description":"This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot\u0026amp;apos;s environment.\r\n\r\nSecurity Fix(es):\n\nAn integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite.(CVE-2024-57256)\n\nInteger overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.(CVE-2024-57258)","status":"published","published":"2025-02-28T11:08:18Z","modified":"2026-08-18T01:18:48.265610591Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.253598Z"},{"id":"UBUNTU-CVE-2024-57258","description":"Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64.","status":"published","published":"2025-02-18T23:15:00Z","modified":"2026-10-17T12:57:25.017437995Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:15.331356Z"},{"id":"DLA-4150-1","title":"u-boot - security update","status":"published","published":"2025-05-01T00:00:00Z","modified":"2026-03-09T02:09:33.100542Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"SUSE-SU-2025:0755-1","title":"Security update for u-boot","description":"This update for u-boot fixes the following issues:\n\n- CVE-2024-57256: integer overflow in U-Boot's ext4 symlink resolution function (bsc#1237284).\n- CVE-2024-57258: multiple integer overflows in U-Boot's memory allocator (bsc#1237287).\n","status":"published","published":"2025-02-28T16:37:11Z","modified":"2026-02-04T04:27:16.069399Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0763-1","title":"Security update for u-boot","description":"This update for u-boot fixes the following issues:\n\n- CVE-2024-57256: integer overflow in U-Boot's ext4 symlink resolution function (bsc#1237284).\n- CVE-2024-57258: multiple integer overflows in U-Boot's memory allocator (bsc#1237287).\n","status":"published","published":"2025-03-03T08:43:14Z","modified":"2026-02-04T04:37:46.982617Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0817-1","title":"Security update for u-boot","description":"This update for u-boot fixes the following issues:\n\n- CVE-2024-57256: integer overflow in U-Boot's ext4 symlink resolution function (bsc#1237284).\n- CVE-2024-57258: multiple integer overflows in U-Boot's memory allocator (bsc#1237287).\n","status":"published","published":"2025-03-10T13:59:32Z","modified":"2026-02-04T03:19:14.162903Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0989-1","title":"Security update for u-boot","description":"This update for u-boot fixes the following issues:\n\n- CVE-2024-57256: integer overflow in U-Boot's ext4 symlink resolution function (bsc#1237284).\n- CVE-2024-57258: multiple integer overflows in U-Boot's memory allocator (bsc#1237287).\n","status":"published","published":"2025-03-24T09:32:42Z","modified":"2026-02-04T02:37:07.499412Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:20219-1","title":"Security update for u-boot","description":"This update for u-boot fixes the following issues:\n\n- CVE-2024-57256: Fixed integer overflow in U-Boot's ext4 symlink resolution function (bsc#1237284)\n- CVE-2024-57258: Fixed multiple integer overflows in U-Boot's memory allocator (bsc#1237287) \n\n","status":"published","published":"2025-04-29T11:10:08Z","modified":"2026-03-23T04:47:11.449552Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"USN-8056-1","title":"u-boot vulnerabilities","description":"Simon Diepold discovered that U-Boot incorrectly handled certain DHCP\nresponses. An attacker on the local network could possibly use this issue\nto obtain sensitive memory contents. (CVE-2024-42040)\n\nIt was discovered that U-Boot incorrectly handled symlink size calculations\nin squashfs file systems. An attacker could use this issue with a specially\ncrafted squashfs file system to cause U-Boot to crash, resulting in a denial\nof service, or execute arbitrary code. (CVE-2024-57254)\n\nIt was discovered that U-Boot incorrectly handled inode size calculations\nin squashfs file systems. An attacker could use this issue with a specially\ncrafted squashfs file system to cause U-Boot to crash, resulting in a denial\nof service, or execute arbitrary code. (CVE-2024-57255)\n\nIt was discovered that U-Boot incorrectly handled inode size calculations\nin EXT4 file systems. An attacker could use this issue with a specially\ncrafted EXT4 file system to cause U-Boot to crash, resulting in a denial of\nservice, or execute arbitrary code. (CVE-2024-57256)\n\nIt was discovered that U-Boot incorrectly handled deep symlink nesting in\nsquashfs file systems. An attacker could possibly use this issue with a\nspecially crafted squashfs file system to cause U-Boot to crash, resulting\nin a denial of service. (CVE-2024-57257)\n\nIt was discovered that U-Boot incorrectly handled memory allocation in\nsquashfs file systems. An attacker could use this issue with a specially\ncrafted squashfs file system to cause U-Boot to crash, resulting in a denial\nof service, or execute arbitrary code. (CVE-2024-57258)","status":"published","published":"2026-02-23T13:04:26Z","modified":"2026-04-27T18:39:10.316314Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}