CVE-2026-29008highCWE-191

CVE-2026-29008: falha de alta gravidade em u-boot

U-Boot 2026.04-rc3 Integer Underflow DoS via tcp_rx_state_machine()

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar u-boot+ Monitorar u-boot

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8.7epss 0.7%
U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c) that allows a network-adjacent attacker to crash the bootloader by sending a malformed TCP SYN+ACK packet with a manipulated data offset field causing payload_len to become negative. When the TCP_SYN_SENT handler calls tcp_rx_user_data() without invoking tcp_seg_in_wnd() validation, the negative payload_len is implicitly converted to a large unsigned integer (e.g., 0xFFFFFFD8) and passed to memcpy() in store_block(), causing an immediate crash that prevents device boot and may enable memory corruption when CONFIG_LMB is disabled.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
u-boot · u-boot
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — u-boot

No mesmo produto, das mais perigosas para as menos.

CVE-2026-29009HIGHU-Boot < 2026.07-rc2 Buffer Overflow in nfs_readlink_reply() via NFS READLINKEPSS 0.7%CVE-2026-29007MEDIUMU-Boot 2026.04-rc3 Out-of-Bounds Read in tcp_rx_state_machine via tcp.cEPSS 0.7%CVE-2026-71971HIGHU-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment ReassemblyEPSS 0.4%CVE-2026-74221HIGHU-Boot before 2026.10-rc5 Buffer Overflow via NFS READLINKEPSS 0.3%CVE-2026-74220HIGHU-Boot before 2026.10-rc5 Buffer Overflow via NFS READ ReplyEPSS 0.3%CVE-2026-74222HIGHU-Boot before 2026.10-rc5 Use-After-Free in lwIP wget Receive CallbackEPSS 0.3%