CVE-2024-57256

CVE-2024-57256 is an integer overflow vulnerability found in the ext4 symlink resolution function of Das U-Boot (Universal Boot Loader). This vulnerability allows an attacker who can manipulate ext4 filesystem data structures to potentially corrupt memory within U-Boot. Systems using verified boot could have their chain of trust bypassed, enabling malicious code execution. U-Boot is a widely used boot loader for embedded systems based on various processors, including PowerPC, ARM, and MIPS. It initializes and tests hardware, and loads/runs application code. The vulnerability affects versions of U-Boot prior to 2025.01-rc1. Upgrading to version 2025.01-rc1 or later mitigates this vulnerability.