linux/poky.git/meta/recipes-bsp/u-boot, branch scarthgap

u-boot: fix CVE-2025-24857

2026-05-12T20:31:33+00:00

According to [1], Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code. Backport a patch [2] from upstream to fix CVE-2025-24857 [1] https://nvd.nist.gov/vuln/detail/CVE-2025-24857 [2] https://source.denx.de/u-boot/u-boot/-/commit/87d85139a96a39429120cca838e739408ef971a2 (From OE-Core rev: 6f69c878896b536f5f7b16c566d420e188c82c7f) Signed-off-by: Hongxu Jia Signed-off-by: Fabien Thomas Signed-off-by: Paul Barker

u-boot: move CVE patches out of the common .inc file

2026-02-27T17:45:07+00:00

An external layer might use the u-boot*.inc files but have a different base version for which the CVE patches don't apply. Move the CVE patches in the leaf recipe. See related patch in kirkstone: [kirkstone][PATCH] u-boot: move CVE patch out of u-boot-common.inc https://lists.openembedded.org/g/openembedded-core/topic/117385432 (From OE-Core rev: f4ced8ff03147dd532a88cf3ce08d61fab057522) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker Signed-off-by: Richard Purdie

u-boot: fix CVE-2024-42040

2025-11-03T15:17:02+00:00

Backport a patch [1] from upstrem to fix CVE-2024-42040 [2] [1] https://source.denx.de/u-boot/u-boot/-/commit/81e5708cc2c865df606e49aed5415adb2a662171 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-42040 (From OE-Core rev: 5c086db3f44d44f31e90f95ccb429639a1ff481d) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

uboot: Allow for customizing installed/deployed file names

2025-07-07T14:42:58+00:00

Backport from master: https://git.openembedded.org/openembedded-core/commit/?id=debc691853e2954bd325bad395b8829939afaa08 When assembling all of the various filenames that are installed/deployed from u-boot, we have been including the PV and PR in the filenames. This change introduces a single variable to replace these two in the filenames. This change should not be disruptive since the default value for the new UBOOT_VERSION variable is "${PV}-${PR}". In one case (UBOOT_EXTLINUX_SYMLINK [1]), PR was used without PV, this patch assumes this was a mistake and corrects it as PR would not be of much use alone. [1] https://git.openembedded.org/openembedded-core/commit/?h=master-next&id=33df3a65f3e8e136811da715d0cc247ce66ae0ea (From OE-Core rev: 58ad450e84db35d5b38dab65edbbc33bc6fef750) Signed-off-by: Ryan Eatmon Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-57259

2025-02-28T14:45:14+00:00

sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation. https://nvd.nist.gov/vuln/detail/CVE-2024-57259 (From OE-Core rev: 8fad176e6258a44d1ba1eed224cd27745b6a57cf) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-57258

2025-02-28T14:45:14+00:00

Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64. https://nvd.nist.gov/vuln/detail/CVE-2024-57258 (From OE-Core rev: 12e1d55ae2427b6aaca6a1f7d8f947f0d6bbd28d) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-57257

2025-02-28T14:45:14+00:00

A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. https://nvd.nist.gov/vuln/detail/CVE-2024-57257 (From OE-Core rev: 890597539246c0f2b427d60965d5665cf7f4731c) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-57256

2025-02-28T14:45:14+00:00

An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite. https://nvd.nist.gov/vuln/detail/CVE-2024-57256 (From OE-Core rev: 21e6ac6e53112b9dddc5a84f27be5851469b9c46) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-57255

2025-02-28T14:45:14+00:00

An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite. https://nvd.nist.gov/vuln/detail/CVE-2024-57255 (From OE-Core rev: c3784c108f003c6663ca969585414e4a90f06606) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman

u-boot: fix CVE-2024-57254

2025-02-28T14:45:14+00:00

An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem. https://nvd.nist.gov/vuln/detail/CVE-2024-57254 (From OE-Core rev: eea9fee59bc7576bef94f0da466887e4daff0356) Signed-off-by: Hongxu Jia Signed-off-by: Steve Sakoman