CVE-2026-34962
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A denial-of-service vulnerability in barebox prior to version 2026.04.0 allows attackers to cause an infinite loop during directory listing or path resolution by supplying a malicious ext4 filesystem image with a crafted directory entry containing a zero-length value.
Risk Assessment
An attacker can provide a malicious ext4 image that hangs the boot process, preventing normal device operation.
Recommendation
Update barebox to version 2026.04.0 or later, which includes a fix for validating directory entry length values.
Other vulnerabilities in barebox
See all- CVE-2026-34963High
In barebox bootloader prior to version 2026.04.0, multiple memory-safety vulnerabilities exist in the EFI PE loader (efi/loader/pe.c). Integer overflow in virtual image size calculation and missing validation of PointerToRawData lead to undersized heap allocation and out-of-bounds heap read. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot, potentially causing heap buffer overflow and code execution in bootloader context.
- CVE-2026-34961Medium
A vulnerability in barebox prior to version 2026.04.0 allows out-of-bounds reads during ext4 filesystem parsing. Missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c enables attackers to supply a malicious ext4 image via USB, SD card, or network boot.
- CVE-2026-34960Medium
In barebox prior to version 2026.04.0, an out-of-bounds read vulnerability exists in the DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.
Original NVD description (English source)
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS