Out-of-bounds write in U-Boot SPL during FIT image loading because of unchecked properties of image external data

U-Boot v2026.07: https://github.com/u-boot/u-boot/archive/refs/tags/v2026.07.tar.gz.

Image preview

The load_simple_fit function, located in common/spl/spl_fit.c, loads the image described by a FIT node. For images that store their payload as "external" data - i.e., images that declare a data-position or data-offset property rather than carrying an inline data property - the offset and the size of the payload are taken directly from the FIT properties:

	if (!fit_image_get_data_position(fit, node, &offset)) {
		external_data = true;
	} else if (!fit_image_get_data_offset(fit, node, &offset)) {
		log_debug("read offset %x = offset from fit %lx\n",
			  offset, (ulong)offset + ctx->ext_data_offset);
		offset += ctx->ext_data_offset;
		external_data = true;
	}

	if (external_data) {
		ulong read_offset;
		void *src_ptr;

		/* External data */
		if (fit_image_get_data_size(fit, node, &len))
			return -ENOENT;

		/* Dont bother to copy 0 byte data, but warn, though */
		if (!len) {
			log_warning("%s: Skip load '%s': image size is 0!\n",
				    __func__, fit_get_name(fit, node, NULL));
			return 0;
		}

		if (spl_decompression_enabled() &&
		    (image_comp == IH_COMP_GZIP || image_comp == IH_COMP_LZMA))
			src_ptr = map_sysmem(ALIGN(CONFIG_SYS_LOAD_ADDR, ARCH_DMA_MINALIGN), len);
		else
			src_ptr = map_sysmem(ALIGN(load_addr, ARCH_DMA_MINALIGN), len);
		length = len;

		overhead = get_aligned_image_overhead(info, offset);
		size = get_aligned_image_size(info, length, offset);
		read_offset = fit_offset + get_aligned_image_offset(info,
							    offset);
		log_debug("reading from offset %x / %lx size %lx to %p: ",
			  offset, read_offset, size, src_ptr);

		if (info->read(info, read_offset, size, src_ptr) < length)
			return -EIO;

All three properties (data-position, data-offset, and data-size) are attacker-controlled: they are listed in the exc_prop[] array in boot/image-fit-sig.c and are therefore excluded from the configuration attributes covered by the signature. Neither the source offset nor the size is validated against the bounds of the FIT image or against the capacity of the destination.

Crucially, in the U-Boot SPL, the data is first copied into device RAM using the attacker-controlled metadata, and only afterwards its signature can be verified:

	if (CONFIG_IS_ENABLED(FIT_SIGNATURE)) {
		printf("## Checking hash(es) for Image %s ... ",
		       fit_get_name(fit, node, NULL));
		if (!fit_image_verify_with_data(fit, node, gd_fdt_blob(), src,
						length))
			return -EPERM;
		puts("OK\n");
	}

By the time fit_image_verify_with_data runs, the copy driven by info->read has already taken place, so an inflated data-size overruns the destination before the corruption can be detected. The result is a primitive that copies up to four GiB of data from an attacker-chosen source into a fixed destination.

Note: the 4-byte data-size property is first read into the len variable, which is int. Its value is later assigned to length, which is size_t, and the block-aligned result is stored in size, which is ulong. Therefore, on 32-bit systems the maximum value for size is 0xFFFFFFFF (nearly four GiB). On 64-bit systems, the alignment operation can extend this by one block, resulting in a value of 0x100000000 (four GiB).

The destination of the copy, src_ptr, is derived from the load property of the FIT image node, which is covered by the configuration signature and therefore cannot be modified by the attacker. However, this does not mitigate the issue: because the length of the copy is unbounded, an attacker can still reach memory located after the destination buffer, including the SPL stack. Overwriting the return address saved by the copy routine on that stack yields control over the SPL execution flow.

Image preview

The offset and size taken from the data-position, data-offset, and data-size properties must be validated before they are used to copy the external data into memory. In particular, the size of the copy must be bounded by both the size of the source and the capacity of the destination, and the offset and size arithmetic must be made overflow-safe, so that no data is written outside the intended destination buffer before the image signature has been verified.

The issue has been fixed in upstream U-Boot with commit 8f71d71.

Image preview

Aristo Chen from the Canonical team (https://github.com/AristoChen).

Image preview