Integer Overflow Vulnerability in Das U-Boot Affected by SquashFS Filesystem

CVE-2024-57255

What is CVE-2024-57255?

An integer overflow vulnerability exists in the sqfs_resolve_symlink function of Das U-Boot, prior to version 2025.01-rc1. This issue is triggered when handling a specially crafted SquashFS filesystem that contains an inode size of 0xffffffff. As a result, this leads to a malloc operation that allocates zero bytes, ultimately causing a memory overwrite, which can have detrimental effects on the stability and security of the system.

References