CVE-2024-57255

CVE-2024-57255 identifies an integer overflow vulnerability within the `sqfs_resolve_symlink` function in Das U-Boot (an open-source primary bootloader). Versions of Das U-Boot prior to 2025.01-rc1 are affected. This vulnerability occurs during the handling of symbolic links within SquashFS, a compressed read-only filesystem commonly used in embedded systems. The integer overflow stems from improper calculations when resolving symbolic links. While technical specifics and exploits aren't currently public, the vulnerability is considered easy to exploit and requires local access. Upgrading to Das U-Boot version 2025.01-rc1 or later mitigates this vulnerability. Note that this information is current as of February 19, 2025, and may change as more details become available.