CyberRota Analysis
AI-GeneratedThe vulnerability affects U-Boot versions prior to 2026.07-rc2, specifically when CONFIG_CMD_NFS is enabled, allowing an attacker to exploit a buffer overflow in the nfs_readlink_reply() function. By sending multiple large relative symlink targets from a malicious NFS server, an attacker can corrupt critical variables in memory, potentially gaining control over the NFS client state machine. Organizations using U-Boot with NFS enabled should prioritize patching this vulnerability to mitigate the risk of memory corruption and unauthorized access.
Original NVD Description
U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious or compromised NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets that are appended without cumulative length validation. Attackers can send two or more READLINK responses containing relative symlink targets of approximately 1100 bytes each to corrupt adjacent BSS variables including nfs_server_ip, nfs_server_mount_port, nfs_server_port, nfs_our_port, nfs_state, and rpc_id, potentially achieving memory corruption and control over the NFS client state machine.
Related CVEs
Other vulnerabilities affecting the same vendor(s)