CVE-2024-57254

CVE-2024-57254 is an integer overflow vulnerability found in Das U-Boot (Universal Boot Loader) prior to version 2025.01-rc1. The vulnerability exists in the `sqfs_inode_size` function during the calculation of symlink size. Specifically, it can be triggered by a specially crafted SquashFS filesystem, potentially leading to further vulnerabilities, especially if the size calculation is used for resource management or execution control. Das U-Boot is a widely used boot loader in embedded systems, often used to initialize hardware and load the operating system. A SquashFS filesystem is a compressed read-only filesystem commonly used in embedded systems due to its small size. Exploiting this vulnerability requires local access. Upgrading to Das U-Boot version 2025.01-rc1 or later mitigates this vulnerability.