Widespread U-Boot Flaws Put Devices at Risk of Stealthy Firmware Attacks
A recent security audit has uncovered six critical vulnerabilities in the widely used open-source bootloader, U-Boot. These flaws could allow attackers to execute malicious code during device boot, potentially enabling stealthy firmware attacks that compromise security protections and install persistent malware.
U-Boot is a ubiquitous component found in many embedded Linux devices, including enterprise servers’ Baseboard Management Controllers (BMCs), networking equipment, industrial systems, IoT devices, and other appliances. As it’s responsible for loading the operating system, vulnerabilities in U-Boot can allow attackers to compromise a device before its security software has a chance to start.
One of the primary security features in U-Boot is Verified Boot, which uses cryptographic signatures to ensure that only firmware and operating system images signed by a trusted key are loaded during startup. However, the Binarly Research team discovered six vulnerabilities in U-Boot’s FIT signature verification code, including two flaws that can potentially lead to arbitrary code execution during firmware verification.
Arbitrary code execution during firmware verification is particularly concerning because it allows attackers to execute malicious code before the operating system loads. This could enable them to disable security features, modify the boot process, install persistent firmware malware, or carry out other malicious actions with high levels of access.
The vulnerabilities are not limited to newer versions of U-Boot either – most of the vulnerable code has existed since version 2013.07, potentially affecting over 50 releases of the project as well as vendors who utilized the vulnerable code in their own firmware.
Binarly reports that exploiting these vulnerabilities does not always require physical access, and on systems such as BMCs that support remote firmware updates, an attacker could upload a specially crafted firmware image to exploit the flaws.
Fortunately, Binarly has reported the vulnerabilities to the U-Boot maintainers and submitted patches for all six issues. These patches have since been accepted into the project’s upstream codebase, but it will likely take some time before vendors incorporate these fixes into their firmware updates and distribute them to customers.
Older or unsupported devices that no longer receive security updates may never be patched, leaving them vulnerable to exploitation.
For users of U-Boot-based devices, this means it’s essential to stay vigilant and regularly review the security patches provided by your device manufacturer. Even if you’re not running a supported version of U-Boot, keeping an eye on firmware update announcements from vendors can help ensure you’re protected against these vulnerabilities.
In the meantime, users should be aware that stealthy firmware attacks may become more common as attackers exploit these newly disclosed vulnerabilities.
Source: Bleeping Computer — 2026-07-10