CVE Feed

    Dashboard / CVE / CVE-2024-57262

    CVE-2024-57262

    In barebox before 2025.01.0, ext4fs_read_symlink has an integer overflow for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite, a related issue to CVE-2024-57256.

    Published:Feb 19, 2025
    Last Modified:Apr 15, 2026
    EPS:Feb 19, 2025
    EPSS Score:0.00022
    CVSS Score:7.1

    Affected Products

    Vendor
    Pengutronix
    Product
    Barebox

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-190 Integer Overflow or Wraparound

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-34963 (CVSS 8.6) — barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi…
    CVE-2026-34962 (CVSS 6.9) — barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/…
    CVE-2026-34961 (CVSS 6.9) — barebox prior to version 2026.04.0 contains out-of-bounds read vulnerabilities in ext4 extent parsing due to m…
    CVE-2026-34960 (CVSS 7.1) — barebox prior to version 2026.04.0 contains an out-of-bounds read vulnerability in DHCP option parsing within …
    CVE-2026-33243 (CVSS 8.2) — barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding …
    CVE-2024-57261 (CVSS 7.1) — In barebox before 2025.01.0, request2size in common/dlmalloc.c has an integer overflow, a related issue to CVE…
    CVE-2021-37848 (CVSS 7.5) — common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used du…
    CVE-2021-37847 (CVSS 7.5) — crypto/digest.c in Pengutronix barebox through 2021.07.0 leaks timing information because memcmp is used durin…
    CVE-2020-13910 (CVSS 9.1) — Pengutronix Barebox through v2020.05.0 has an out-of-bounds read in nfs_read_reply in net/nfs.c because a fiel…
    CVE-2019-15937 (CVSS 9.8) — Pengutronix barebox through 2019.08.1 has a remote buffer overflow in nfs_readlink_reply in net/nfs.c because …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High