CVE-2026-33243

Name
CVE-2026-33243
Description
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/barebox/barebox/commit/aca01795056d51060cb096f9a1ea309361743e05
security-advisories@github.com https://github.com/barebox/barebox/security/advisories/GHSA-3fvj-q26p-j6h4

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:* u-boot >= 2013.07 < 2026.04
cpe:2.3:a:denx:u-boot:2026.04:rc1:*:*:*:*:*:* u-boot == None == 2026.04
cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:* barebox >= 2016.03.0 < 2025.09.3
cpe:2.3:a:pengutronix:barebox:*:*:*:*:*:*:*:* barebox >= 2025.10.0 < 2026.03.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
u-boot edge-main 2026.04-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2026.01-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2026.01-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.10-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.07-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.04-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.04-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.04-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2025.01-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2024.10-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2024.10-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2021.04-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2021.04-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2021.04-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot edge-main 2021.04-r0 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.23-main 2025.10-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.23-main 2025.10-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r7 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2025.04-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.22-main 2021.04-r0 None possibly vulnerable
u-boot 3.21-main 2024.10-r8 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r7 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2024.10-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.21-main 2021.04-r0 None possibly vulnerable
u-boot 3.20-main 2024.04-r7 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r2 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2024.04-r1 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.20-main 2021.04-r0 None possibly vulnerable
u-boot 3.19-main 2023.10-r9 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r8 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r7 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r6 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r5 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r4 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2023.10-r3 Milan P. Stanić <mps@arvanta.net> possibly vulnerable
u-boot 3.19-main 2021.04-r0 None possibly vulnerable