Re: [security] Report of possible heap buffer overflow in U-Boot EFI image verification under Secure Boot (ANT-2026-R09Q9YM0)

On 8/6/26 14:15, Arthur Chan wrote:
> Hello U-Boot maintainers,
> 
> I'd like to report a High-severity security issue in  U-Boot (https:// 
> github.com/u-boot/u-boot / https://git.u-boot-project.org/u-boot/u-boot) 
> related to possible heap buffer overflow in U-Boot EFI image 
> verification under Secure Boot.
> 
> I have attached 3 files with this email as described below.
> 1) report.md: A full description of the vulnerability and how to 
> reproduce it, together with suggested fix of the issue.
> 2) Dockerfile: A Dockerfile for demonstrating the issue.
> 3) driver.c: Work with the Dockerfile to demonstrate the issue.
> 
> Attribution
> *-----------*
> Please attribute Claude and Ada Logics. This issue was found by 
> Anthropic from using agents to study security of open source projects, 
> and I am from Ada Logics helping validate the found issues and creating 
> the report manually and notify the maintainers.
> 
> Disclosure
> *----------*
> This report follows a 90-day coordinated disclosure deadline. I'm happy 
> to coordinate on the exact timing and to provide any further detail you 
> need.
> 
> Kind regards,
> Arthur Chan
> 
> 
> ADA Logics Ltd is registered in England. No: 11624074.
> Registered office: 266 Banbury Road, Post Box 292,
> OX2 7DL, Oxford, Oxfordshire , United Kingdom


@Ilias

There is no guarantee that the private exponent fits into 8 bytes. But 
it would be highly unusual.

To be fully RSA compliant we probably would need to rewrite a lot of 
code. An easier approach is probably to error out on long private exponents.

Best regards

Heinrich