Six New U-Boot Flaws Could Let Malicious Images Crash Devices or Run Code at Boot

Researchers at Binarly discovered six vulnerabilities in U-Boot, a program used to start up various hardware devices. The affected devices include home routers, smart cameras, and management chips in data-center servers. Four of the identified flaws can cause a device to crash. The remaining two vulnerabilities could allow an attacker to run their own code before the device boots, by inserting a malicious image in front of the bootloader. These flaws pose a potential risk to devices that use U-Boot. The vulnerabilities could be exploited by attackers who can insert malicious images into the boot process.