Multiple U-Boot Vulnerabilities Enable Pre-Authentication Code Execution and Device DoS Attacks

Six critical vulnerabilities in the widely used U-Boot bootloader, which can be exploited through malicious Flattened Image Tree (FIT) images, allowing attackers to achieve pre-authentication arbitrary code execution or crash devices during the early boot process.

U-Boot is foundational to a wide range of embedded platforms, including consumer routers, IoT devices, and Baseboard Management Controllers (BMCs) used for remote server management in data centers. Consequently, weaknesses at this stage can have significant ramifications.

Since U-Boot runs before the operating system and often enforces verified boot across various designs, compromising it would dismantle the entire chain of trust for downstream firmware and software components.

The Binarly research focused on U-Boot’s Verified Boot implementation, specifically the FIT signature verification, which ensures the integrity and authenticity of bundled firmware components before execution.

Multiple U-Boot Vulnerabilities

An analysis of the latest stable U-Boot release, version 2026.04, uncovered six previously unknown vulnerabilities in the FIT parsing and verification logic.

Some of these vulnerabilities date back to code present as far back as version 2013.07. This implies that over 50 upstream releases and numerous vendor forks may be affected if they have not yet integrated the necessary fixes.

All six vulnerabilities are triggered while handling untrusted FIT images before signature validation is complete, enabling attackers to exploit malformed images as an initial entry point.

The combined impact of these vulnerabilities falls into two major categories: arbitrary code execution and denial-of-service. Two of the issues can be chained together to achieve reliable pre-authentication code execution by corrupting stack state and overriding return addresses during U-Boot’s verification routines.

The remaining four vulnerabilities primarily lead to denial-of-service conditions, wherein crafted images cause NULL pointer dereferences, out-of-bounds reads, or stack exhaustion during FIT processing.

This can leave the device unable to boot without manual recovery, such as reflashing the SPI flash. In security-sensitive deployments, even a denial-of-service attack at the bootloader level can have severe operational consequences, especially for remote or unattended systems.

The six vulnerabilities are tracked under Binarly advisories BRLY-2026-037 through BRLY-2026-042 and are summarized as follows:

• BRLY-2026-037: Null pointer dereference and potential stack-based buffer overflow in `fdt_find_regions` during FIT image signature verification.
• BRLY-2026-038: Stack buffer underflow in `fdt_find_regions` caused by negative length values propagated from failed `fdt_get_name` calls.
• BRLY-2026-039: Denial of service through unchecked size values of the hashed-strings property, leading to out-of-bounds reads from the strings region.
• BRLY-2026-040: Denial of service due to NULL pointer dereference when `fdt_get_property_by_offset` returns NULL for older FDT versions.
• BRLY-2026-041: Denial of service through unchecked external data properties (data-position/data-offset/data-size) pointing outside valid image bounds.
• BRLY-2026-042: Unbounded recursion in `fdt_check_no_at` during FIT format validation, resulting in stack exhaustion on deeply nested trees.

While bootloader attacks are often thought to require physical access, Binarly notes that in real-world scenarios, attackers can sometimes reach U-Boot indirectly via legitimate firmware update mechanisms exposed through BMC or management interfaces.

In previous research on Supermicro BMC platforms, the team demonstrated that remote adversaries with access to management consoles could exploit update logic to push malicious images, bypassing existing checks and reflashing the SPI with attacker-controlled firmware.

This same pattern could facilitate the delivery of weaponized FIT images that exploit these U-Boot vulnerabilities, especially in data center or cloud environments where out-of-band management is exposed.

Binarly coordinated the disclosure of these vulnerabilities with U-Boot maintainers and provided patches for all six issues, which have since been merged into the project’s main branch.

The fixes implement robust NULL checks, enforce bounds validation for offsets and sizes, and limit recursion depth using the existing `FDT_MAX_DEPTH` parameter to prevent stack exhaustion.

Vendors and integrators building on U-Boot are strongly encouraged to adopt the latest changes, backport the relevant commits to their branches, and prioritize updates for any devices capable of ingesting untrusted or remotely supplied FIT images.

The findings underscore the necessity for low-level boot components to receive the same rigorous secure coding, hardening, and continuous auditing as higher-level software in the stack.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN