Description
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directory entry length values are non-zero. Attackers can supply a malicious ext4 filesystem image with a crafted directory entry containing a direntlen value of 0 to cause an infinite loop during directory listing or path resolution, resulting in the boot process hanging indefinitely.
Problem types
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
Product status
Any version
Credits
Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
References
github.com/barebox/barebox
github.com/barebox/barebox/releases/tag/v2026.04.0
www.vulncheck.com/...parsing-infinite-loop-denial-of-service