Re: [security] Report of possible heap overflow in U-Boot's Android bootmeth before any AVB verification (ANT-2026-ZWED60S8)
Mattijs Korpershoek <[email protected]>
| Newsgroups | org.u-boot-project.lists.u-boot |
|---|---|
| Message-ID | <[email protected]> |
Hi Arthur, Thank you for the report. On Thu, Aug 06, 2026 at 08:52, Simon Glass <[email protected]> wrote: > Hi Arthur, > > On Thu, 6 Aug 2026 at 06:23, Arthur Chan <[email protected]> wrote: >> >> Hello U-Boot maintainers, >> >> I'd like to report a High-severity security issue in U-Boot (https://github.com/u-boot/u-boot / https://git.u-boot-project.org/u-boot/u-boot) related to possible heap overflow in U-Boot's Android bootmeth before any AVB verification. > > Thanks for the report. > >> >> I have attached 3 files with this email as described below. >> 1) report.md: A full description of the vulnerability and how to reproduce it, together with suggested fix of the issue. >> 2) Dockerfile: A Dockerfile for demonstrating the issue. >> 3) driver.c: Work with the Dockerfile to demonstrate the issue. >> >> Attribution >> ----------- >> Please attribute Claude and Ada Logics. This issue was found by Anthropic from using agents to study security of open source projects, and I am from Ada Logics helping validate the found issues and creating the report manually and notify the maintainers. > > If this is a standard text, I suggest '...issues found, manually > create a report and notify...'. > > Are you able to send a patch? Then your attribution will be in the > source tree :-) I agree with Simon here. I also think someone else found a similar fix and proposed a patch already which is here: https://lore.kernel.org/all/[email protected]/ If you wish to contribute to U-Boot, please apply above patch and let us know if that patch fixes the issue you've reported. You can contribute by replying to above email using Tested-by:, for example. > > Also I suggest avoiding HTML in email to the mailing list. Yes, see: https://docs.u-boot-project.org/en/latest/develop/sending_patches.html#general-patch-submission-rules Thanks, Mattijs > >> >> Disclosure >> ---------- >> This report follows a 90-day coordinated disclosure deadline. I'm happy to coordinate on the exact timing and to provide any further detail you need. >> >> Kind regards, >> Arthur Chan >> >> >> >> ADA Logics Ltd is registered in England. No: 11624074. >> Registered office: 266 Banbury Road, Post Box 292, >> OX2 7DL, Oxford, Oxfordshire , United Kingdom > > Regards, > Simon