CVE-2026-33243
Hash Manipulation in barebox FIT Signature Allows Boot Bypass
Publication date: 2026-03-20
Last updated on: 2026-03-26
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| denx | u-boot | From 2013.07 (inc) to 2026.04 (exc) |
| denx | u-boot | 2026.04 |
| denx | u-boot | 2026.04 |
| denx | u-boot | 2026.04 |
| pengutronix | barebox | From 2016.03.0 (inc) to 2025.09.3 (exc) |
| pengutronix | barebox | From 2025.10.0 (inc) to 2026.03.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the barebox bootloader versions from 2016.03.0 to before 2025.09.3 and from 2025.10.0 to before 2026.03.1. When creating a FIT (Flattened Image Tree), the mkimage tool sets a property called hashed-nodes in the FIT signature node. This property lists which nodes of the FIT were hashed during the signing process and are expected to be verified by the bootloader later.
However, the hashed-nodes property itself is not included in the hash. This means an attacker can modify the hashed-nodes property to mislead the bootloader into booting images that were not actually verified, potentially bypassing security checks.
This issue has been fixed in barebox versions 2025.09.3 and 2026.03.1.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with local access and high privileges to modify the hashed-nodes property in the FIT signature node, causing the bootloader to boot unverified or malicious images.
As a result, the attacker could execute unauthorized code during the boot process, potentially leading to full system compromise, loss of confidentiality, integrity, and availability of the system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade barebox to a patched version. The issue has been fixed in barebox versions 2025.09.3 and 2026.03.1.