New U-Boot flaws could enable stealthy firmware attacks, according to a report published by firmware security company Binarly. The vulnerabilities, discovered in the widely used U-Boot bootloader, could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks that compromise security protections and install persistent malware.
U-Boot Bootloader Vulnerabilities
U-Boot is one of the world's most widely used open-source bootloaders, found in many embedded Linux devices, including enterprise servers' Baseboard Management Controllers (BMCs), networking equipment, industrial systems, IoT devices, and other appliances. Because U-Boot is responsible for loading the operating system, vulnerabilities in the bootloader can allow attackers to compromise a device before the operating system and its security software have a chance to start.
One of its security features, known as Verified Boot, uses cryptographic signatures to ensure that only firmware and operating system images signed by a trusted key are loaded during startup. However, the six disclosed vulnerabilities in U-Boot's FIT (Flattened Image Tree) signature verification code could potentially bypass this security feature.
Vulnerability Details
The six vulnerabilities, disclosed by Binarly, are:
- BRLY-2026-037: A flaw that can cause U-Boot to crash when processing a malicious firmware image and, under certain conditions, can be used for arbitrary code execution.
- BRLY-2026-038: A memory corruption vulnerability that could allow attackers to execute arbitrary code during firmware signature verification.
- BRLY-2026-039: An out-of-bounds read vulnerability that can crash devices by forcing U-Boot to read beyond the firmware image.
- BRLY-2026-040: A null pointer dereference that allows specially crafted firmware images to crash the bootloader.
- BRLY-2026-041: Improper validation of externally stored firmware data that can cause U-Boot to crash when processing malicious firmware images.
- BRLY-2026-042: An unbounded recursion flaw that can exhaust available stack memory and crash the bootloader.
According to Binarly, most of the vulnerable code has existed since U-Boot version 2013.07, causing the flaws to potentially affect more than 50 releases of the project as well as vendors who utilized the vulnerable code in their own firmware.
Impact and Exploitation
If successfully exploited, the arbitrary code execution vulnerabilities could allow attackers to execute code during the earliest stages of the boot process. Because this occurs before the operating system loads, attackers could potentially disable firmware security features, modify the boot process, install persistent firmware malware, or carry out other malicious actions with high levels of access.
Binarly notes that malicious activity would be difficult to detect because it executes before the operating system starts. Additionally, exploiting these vulnerabilities does not always require physical access, as an attacker who has already compromised the management interface could upload a specially crafted firmware image to exploit the flaws on systems that support remote firmware updates, such as BMCs.
Binarly reported the vulnerabilities to the U-Boot maintainers and submitted patches for all six issues, which have since been accepted into the project's upstream codebase. However, because U-Boot is integrated into firmware by individual hardware manufacturers, the fixes must first be incorporated into vendors' firmware updates before they can be distributed to customers. Older or unsupported devices that no longer receive firmware updates may never be patched.
Test every layer before attackers do. Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Source: BleepingComputer