The ByteRay Blog.

ByteRay finds and fixes eight vulnerabilities in U-Boot

ByteRay found, reproduced and fixed eight memory-safety vulnerabilities in U-Boot. Flaws in BMP and SquashFS parsing could undermine verified boot, and bugs in IP reassembly, NFS, DHCPv6 and HTTP give attackers on the network a potential path to code execution before the operating system starts.

Boot Logo to Bootkit: An Out-of-Bounds Write in U-Boot's RLE8 BMP Decoder

A crafted boot-splash BMP walks U-Boot's RLE8 decoder off the front of the framebuffer and writes attacker bytes into U-Boot's own image. On the SoCs that scan out from DRAM it becomes pre-OS code execution, decoded automatically before anything checks a signature.