Hello, My name is Brian Lee, and I am a PhD Security Researcher in SSLab at Georgia Tech. I'd like to privately report a potential security bug in u-boot where the malicious peripheral learns a small amount of bootloader stack residue during USB storage enumeration. In a realistic bootloader context this can disclose low-volume process/firmware state such as stale stack bytes or address material useful for follow-on local exploit development.
Target: * Project: u-boot * Repo: https://github.com/u-boot/u-boot * Pinned ref: 3cdce049f90d77c3f9221f1eb73922384c8972c3 Threat Model: An attacker with physical access plugs in a malicious USB storage device before the target enters U-Boot storage discovery, or induces an operator/boot flow to scan attached USB storage. The device advertises an ordinary bulk-only SCSI mass-storage interface, passes U-Boot's class/protocol/endpoint checks, and receives the Command Block Wrapper for the normal six-byte INQUIRY command. Because U-Boot sends the full 31-byte CBW after initializing only the six semantic CDB bytes, the device can read ten stale stack bytes in the CBW CDB tail over its bulk OUT endpoint. Attached: When reporting by email, for better readability of the email and for those who prefer private channels when discussing security bugs, we share the full writeup and PoC files via zip file attachment. If you don't want to download an arbitrary zip file and use it, please let us know. The zip file contains: * README.md : full writeup. * poc : the relevant files and scripts for reproducing the PoC I would like to get help from your expertise to clarify whether this is a valid security threat or not. Thank you. Best Regards, Brian Lee
<<attachment: INT-usb-uboot-bbb-cbw-cdb-tail-info-leak.zip>>
