CVE-2026-34155: 
NixOS vulnerability analysis and mitigation

CVE-2026-34155 is an integer overflow vulnerability in RAUC, the robust update agent for embedded Linux systems, that causes cryptographic signatures on 'plain' format bundles exceeding 2 GiB to cover only the first few bytes of the payload rather than the entire content. This allows an attacker in possession of a legitimately signed bundle to modify the uncovered portion of the payload without invalidating the signature. All RAUC versions prior to 1.15.2 are affected; bundles using the 'verity' or 'crypt' formats are not affected. The vulnerability was reported by Akihiko Nishikawa (Sony Semiconductor Solutions Corporation) and Yosuke Tanimoto (Sony Group Corporation) on 2026-03-17, with the advisory published on 2026-03-27. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory).

The root cause is an unsigned-to-signed integer conversion error (CWE-196) in src/signature.c when RAUC calls BIO_new_mem_buf() with a size parameter derived from a gsize (unsigned) value. When a 'plain' format bundle payload exceeds 2 GiB (INT32_MAX), the size value overflows upon conversion to the signed integer expected by OpenSSL's BIO API, causing the memory buffer passed to the CMS signing/verification routines to represent only the first few bytes of the payload. This results in improper verification of the cryptographic signature (CWE-347): the signature is valid but covers only a small prefix of the bundle. An attacker who obtains a legitimately signed bundle larger than 2 GiB can then modify any content beyond the covered prefix and the signature will still verify successfully. The fix in v1.15.2 adds explicit size checks in both cms_sign_file() and cms_verify_fd(), rejecting any 'plain' bundle whose payload exceeds INT32_MAX bytes (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to deliver a tampered firmware or software update bundle to embedded Linux devices managed by RAUC, bypassing the integrity guarantee provided by the bundle's cryptographic signature. The primary impact is on integrity — unauthorized modifications to the update payload can result in deployment of malicious or corrupted firmware. Because RAUC is used in safety- and security-critical embedded systems (e.g., automotive, industrial, IoT), a compromised update could enable persistent device compromise, supply chain attacks, or disruption of device functionality. Confidentiality is not directly impacted, and availability impact on the vulnerable system itself is none, though downstream systems receiving the tampered update could be severely affected (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). Exploitation requires the attacker to have access to a legitimately signed 'plain' format RAUC bundle exceeding 2 GiB, which is a meaningful precondition limiting the attack surface. The EPSS score is approximately 0.027% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability is detectable by the Nessus scanner (plugin ID 304627) (Tenable).

1. Obtain a legitimate signed bundle: Acquire or intercept a legitimately signed RAUC 'plain' format bundle with a payload exceeding 2 GiB (e.g., through access to a vendor's update distribution channel or a man-in-the-middle position on the update delivery network).
2. Identify the uncovered payload region: Determine the portion of the bundle payload that falls beyond the first few bytes covered by the signature due to the integer overflow. The signature covers only the bytes that fit within the overflowed (truncated) size value passed to BIO_new_mem_buf().
3. Modify the uncovered payload: Alter the content of the bundle beyond the covered prefix — for example, replacing firmware images, scripts, or configuration files embedded in the bundle — using standard binary editing tools.
4. Deliver the modified bundle: Distribute the tampered bundle to target embedded Linux devices running a vulnerable version of RAUC (prior to 1.15.2) via the normal update delivery mechanism (e.g., HTTP server, USB, or OTA channel).
5. Trigger update installation: Cause the target device to install the bundle. RAUC will verify the signature, which will pass because the covered prefix is unmodified, and then install the tampered payload without detecting the modification (GitHub Advisory, Patch Commit).

• Logs: RAUC update logs showing successful installation of 'plain' format bundles with payload sizes exceeding 2 GiB on systems running RAUC versions prior to 1.15.2; absence of the error message "Bundle payload size ... exceeds maximum for bundles using plain format (2 GiB)" (which is only emitted by patched versions).
• File System: Presence of unexpectedly large RAUC bundle files (>2 GiB) in update staging directories; unexpected changes to installed firmware images or rootfs partitions following an update event.
• Network: Unusual or unexpected RAUC bundle downloads from update servers, particularly bundles exceeding 2 GiB in size; network traffic delivering bundles from unrecognized or unauthorized sources.

Upgrade RAUC to version 1.15.2 or later, which rejects 'plain' format bundles with payloads exceeding 2 GiB during both signing and verification (RAUC Release). As a workaround, ensure that all signed and published bundles remain smaller than 2 GiB, which prevents the integer overflow from being triggered. The recommended long-term mitigation is to migrate to the 'verity' bundle format (supported since RAUC v1.5, released 2020-12-14) or the 'crypt' format (supported since v1.7, released 2022-06-03), neither of which is affected by this vulnerability. Additionally, implement strict access controls on bundle creation and distribution pipelines to limit the ability of attackers to obtain or tamper with signed bundles (GitHub Advisory).

The vulnerability was responsibly disclosed by researchers from Sony Semiconductor Solutions Corporation and Sony Group Corporation, who notified Pengutronix (the RAUC maintainer) on 2026-03-17, with the advisory published 10 days later on 2026-03-27 (GitHub Advisory). Coverage appeared in Linux-focused security outlets including Pro-Linux.de and LinuxCompatible.org following the Fedora package update announcement. No significant broader media coverage or notable social media discussion has been identified.