CVE-2024-57259: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-57259 affects Das U-Boot versions before 2025.01-rc1, where the sqfssearchdir function contains an off-by-one error that results in heap memory corruption during squashfs directory listing operations. The vulnerability occurs because the path separator is not considered in a size calculation (NVD, OSS Security).

The vulnerability is classified as an off-by-one error (CWE-193) in the sqfssearchdir function. The issue arises because the buffer allocation for storing strings does not account for the path separator character, leading to heap memory corruption. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (NVD).

The vulnerability allows an attacker capable of modifying squashfs filesystem data structures to exploit memory corruption in U-Boot. For systems relying on verified boot, this vulnerability enables attackers to bypass the chain of trust and achieve code execution (Security Online, OSS Security).

Users are advised to upgrade to U-Boot version v2025.01-rc1 or newer. The vulnerability has been fixed in commit 048d795bb5b3d9c5701b4855f5e74bcf6849bf5e, which corrects the buffer size calculation to account for the path separator (U-Boot Commit, OSS Security).