Heap Memory Corruption in Das U-Boot Affected by Off-by-One Error

CVE-2024-57259

What is CVE-2024-57259?

A vulnerability exists in Das U-Boot prior to version 2025.01-rc1, where an off-by-one error impacts the sqfs_search_dir function. This issue leads to heap memory corruption during squashfs directory listing, as the path separator is not taken into account in size calculations. This oversight may allow for unauthorized access and exploitation within impacted systems.

References