Hi all,during a recent assessment I identified a vulnerability in the OOB data parsing of the NAND chip. As you are the maintainers regarding [1], I've sent you the advisory advisory (SYSS-2026-038: Arbitrary OOB Heap Write) including a "optional" fix and a reproducer script which illustrates that the vulnerability can lead to arbitrary code execution in the sandbox.
If you have further questions, please do not hesitate to contact me. Kind regards, Robin [1] https://docs.u-boot.org/en/latest/develop/security.html -------- Forwarded Message -------- Subject: SySS Responsible Disclosure Policy Date: Wed, 10 Jun 2026 15:46:26 +0200 From: Robin Trost <[email protected]> To: [email protected] <[email protected]>CC: [email protected] <[email protected]>, p_mailqueue_disclosure <[email protected]>
Hi all,The SySS GmbH deals with security issues in a responsible way. In the form of a security advisory we report security vulnerabilities which are not in products of our customers and which are not excluded from public disclosure due to contractual agreements with vendors.
The attached security advisories contain detailed information about the found vulnerabilities that allows the vendor to reproduce and further investigate the reported security issue. Vulnerabilities will be disclosed to the public if a solution was published by the vendor or 45 days after the initial report by the SySS GmbH, regardless of the vulnerability status, for example if there is a patch or workaround from the affected vendor. In well-founded exceptional cases, this standard procedure may not be followed and an alternative, adjusted publication schedule will be negotiated with the vendor.
The goal of our Responsible Disclosure Policy is, to weigh up the need of the public to know of security vulnerabilities against the vendor’s time to remedy all security issues effectively. The final publication schedule will be based on the best interests of the community overall, considering both positions. Before the responsible disclosure of a security vulnerability, the SySS GmbH allows vendors the opportunity to analyze reported security issues, to develop effective countermeasures, and to test them thoroughly.
If there are any further questions regarding the identified vulnerabilities do not hesitate to contact me.
Kind regards, -- Robin Trost Senior IT-Security Consultant ______________________________________________________________ SySS GmbH Schaffhausenstraße 77, 72072 Tübingen, Germany Tel: +49 (0)7071 - 40 78 56-6169 Mobil: +49 (0)151 - 42209330 E-Mail: [email protected] Conf. Calls: https://syss.zoom.us/my/robin.trost Web: https://syss.de PGP-Fingerprint: 85FE 80E2 04F3 6177 C61A 4618 61DE F14F 698E 6EB3 Geschäftsführer: Sebastian Schreiber Registergericht: Amtsgericht Stuttgart / HRB 382420 Steuernummer: 86118 / 55809
<<attachment: SYSS-2026-038.zip>>
