On Fri, 12 Jun 2026 13:24:22 +0530, Piyush Paliwal wrote:
> Two independent out-of-bounds reads in the SquashFS driver, both reachable
> by pointing U-Boot at an attacker-supplied image (e.g. ls/load on a crafted
> USB/SD/netboot rootfs). Either one crashes the bootloader (DoS); patch 2 can
> also copy adjacent heap memory into the loaded file (information disclosure).
>
> 1/2 sqfs_find_inode()/sqfs_inode_size() walk the decompressed inode table
> using on-disk sizes with no check that the cursor stays inside the
> buffer -> wild read / SEGV, e.g. from a simple "ls".
> 2/2 sqfs_read_nest() uses the on-disk fragment offset as an unbounded
> source index into the fragment block -> out-of-bounds heap read when
> loading a fragment-backed file.
>
> [...]
Applied to u-boot/main, thanks!
[1/2] fs/squashfs: bound the inode table walk in sqfs_find_inode()
commit: 73ada2f433a99fb2f443bb76268f5ab023b11868
[2/2] fs/squashfs: bound fragment offset/size in sqfs_read_nest()
commit: 923f05ed3e231c51f259bee6e2ac823bdaf1c566
--
Tom
