CyberRota Analysis
AI-GeneratedThe vulnerability exists in U-Boot versions up to 2026.04-rc3, specifically within the tcp_rx_state_machine() function when CONFIG_PROT_TCP is enabled, allowing remote attackers to exploit out-of-bounds reads by sending specially crafted TCP packets. This could lead to the corruption of critical connection state variables, disrupting TCP window calculations and potentially compromising network communication. Organizations utilizing affected U-Boot versions, particularly in embedded systems or network devices, should prioritize patching this vulnerability to mitigate the risk of remote exploitation.
Original NVD Description
U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations.
Related CVEs
Other vulnerabilities affecting the same vendor(s)