The Bootloader: An Underestimated Risk To Embedded Linux Security
summary
Audit finds integer overflows in ext4 and squashfs and a memory allocator overflow due to signed cast, each enabling practical exploits that overwrite control data by crafting filesystem blocks; proof-of-concept runs under QEMU and ASAN, triggers on both U-Boot and Barebox, and leads to CVEs and fixes. Root causes are untrusted block-device parsing and absent DM-verity in bootloaders; recommended mitigations are writing signed FIT images to raw partitions, hardware monotonic rollback counters (eMMC/RPMB), or adding verified-boot block integrity.
AI-written summary · about
chapters (13)
- 0:00Bootloader security risks
- 1:27Bootloader basics and role
- 3:54Chain of trust in secure boot
- 6:22Critical code paths in U-Boot Barebox
- 8:13File systems as Achilles' heel
- 12:07XZ integer overflow
- 14:33SquashFS vulnerabilities
- 16:20Memory allocator bugs
- 19:09Security fixes applied
- 20:58Downgrade attacks threat
- 23:30Bootloader security strategies
- 26:38Q&A
- 30:20Final thoughts
related talks
25mBootStomp: On the Security of Bootloaders in Mobile Devices
27mBreaking the Chain of Trust
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
44mLogoFAIL: Security Implications of Image Parsing During System Boot
24mCurrent State of Exploit Mitigations in the Linux Kernel
47mTop 10 Secure Boot Mistakes
38mHardening the Barebox Bootloader
55mVerified Boot: From ROM to Userspace