According to NCC Group, a serious vulnerability in the U-Boot boot loader might be exploited to write arbitrary data, allowing an attacker to root Linux-based embedded computers.
U-Boot is an open-source boot loader used in a variety of embedded systems, including Chrome OS and Android. It is compatible with a variety of architectures, including 68k, ARM, x86, MIPS, Nios, PPC, and others. According to NCC Group, the IP defragmentation method in U-Boot is plagued by two vulnerabilities that can be exploited by constructing erroneous packets from the local network.
The metadata and fragment can be fabricated to point to the same location as a result of this security flaw, resulting in the metadata being overwritten by fragmented data.
Read More: https://www.securityweek.com/critical-u-boot-vulnerability-allows-rooting-embedded-systems
