CVE-2024-42040

Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/u-boot/u-boot/tags	Release Notes
https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2024-004.txt	Mitigation Third Party Advisory
http://seclists.org/fulldisclosure/2024/Aug/38	Mailing List Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-08-23 15:15

Updated : 2026-06-17 07:48

NVD link : CVE-2024-42040

Mitre link : CVE-2024-42040

CVE.ORG link : CVE-2024-42040

JSON object : View

Products Affected

denx

u-boot

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2024-42040", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-42040", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-26T17:09:28.948747Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2024-08-23T15:15:16.323", "references": [{"url": "https://github.com/u-boot/u-boot/tags", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2024-004.txt", "tags": ["Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2024/Aug/38", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on the local network to leak memory from four up to 32 bytes of memory stored behind the packet to the network depending on the later use of DHCP-provided parameters via crafted DHCP responses."}, {"lang": "es", "value": "Vulnerabilidad de desbordamiento de b\u00fafer en net/bootp.c en DENEX U-Boot desde su confirmaci\u00f3n inicial en 2002 (3861aa5) hasta hoy en cualquier plataforma permite a un atacante en la red local perder memoria de cuatro a 32 bytes de memoria almacenados detr\u00e1s el paquete a la red dependiendo del uso posterior de los par\u00e1metros proporcionados por DHCP a trav\u00e9s de respuestas DHCP manipuladas."}], "lastModified": "2026-06-17T07:48:41.493", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "76B1F7E6-2BC5-4BFB-9631-25E554C262F4", "versionEndIncluding": "2025.10"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}