New U-Boot flaws could enable stealthy firmware attacks

Binarly disclosed six vulnerabilities in U-Boot's FIT signature verification code that can lead to crashes and, in two cases, arbitrary code execution during the boot process; the flaws affect many releases (dating back to 2013.07) and thus numerous embedded devices (BMCs, networking gear, IoT, industrial systems). Exploitation could allow pre-OS compromise, persistent firmware malware, or disabled firmware protections; patches were submitted upstream but device vendors must incorporate fixes into firmware updates, leaving older or unsupported devices at risk.