Hello, My name is Brian Lee, and I am a PhD Security Researcher in SSLab at Georgia Tech. I'd like to privately report a potential security bug in u-boot where the attacker can make a U-Boot NFS boot consume stack bytes as a pathname. In the non-slash branch, several uninitialized stack bytes can be copied into the next NFS path value and exposed back to the same NFS peer in follow-up path operations.
Target: * Project: u-boot * Repo: https://github.com/u-boot/u-boot * Pinned ref: 3cdce049f90d77c3f9221f1eb73922384c8972c3 Threat Model: During an NFS boot, the bootloader sends an NFSv2 READLINK request for a symlinked path component. The attacker replies with a syntactically successful RPC/NFS response whose READLINK length says eight path bytes are present, but whose UDP payload ends immediately after the length field. U-Boot accepts the reply, reads the absent first path byte from its stack, and then may copy the absent path area into the global NFS path before continuing the boot state machine with a corrupted pathname. Attached: When reporting by email, for better readability of the email and for those who prefer private channels when discussing security bugs, we share the full writeup and PoC files via zip file attachment. If you don't want to download an arbitrary zip file and use it, please let us know. The zip file contains: * README.md : full writeup. * poc : the relevant files and scripts for reproducing the PoC I would like to get help from your expertise to clarify whether this is a valid security threat or not. Thank you. Best Regards, Brian Lee
<<attachment: INT-nfs-uboot-readlink-short-reply-uninit.zip>>
