CVE-2024-42040: Denx U-boot Buffer Overflow Vulnerability

CVE-2024-42040 Overview

CVE-2024-42040 is a buffer overflow vulnerability in the net/bootp.c component of DENX U-Boot, a widely deployed open-source bootloader used across embedded systems. The flaw has existed since the initial commit in 2002 (3861aa5) and affects all subsequent versions across every supported platform. An attacker on the local network can craft malicious DHCP responses that cause U-Boot to leak between 4 and 32 bytes of memory stored behind the DHCP packet buffer. The leaked bytes depend on later use of DHCP-provided parameters. The issue is classified under CWE-120: Buffer Copy without Checking Size of Input.

Critical Impact
An adjacent-network attacker can leak sensitive memory contents from embedded devices during network boot and disrupt the boot process without authentication or user interaction.

Affected Products

DENX U-Boot from commit 3861aa5 (2002) through releases prior to the fix
All hardware platforms supported by U-Boot that use the BOOTP/DHCP network stack
Embedded systems, IoT devices, and appliances that rely on U-Boot for network boot

Discovery Timeline

2024-08-23 - CVE-2024-42040 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42040

Vulnerability Analysis

The vulnerability lives in the BOOTP/DHCP processing routines inside net/bootp.c. U-Boot allocates a fixed-size buffer to receive DHCP responses and does not correctly account for the trailing memory when parsing certain option fields. When the bootloader interprets crafted DHCP responses, it reads beyond the intended packet boundary and processes between 4 and 32 bytes of adjacent memory as if it were option data.

The practical impact depends on how the DHCP-supplied parameters are consumed after parsing. Fields that end up rendered in log output, embedded in TFTP requests, or reflected back on the network can leak the out-of-bounds bytes to an attacker positioned on the same broadcast domain. Attackers can also corrupt boot behavior, producing denial-of-service conditions during device initialization.

Root Cause

The root cause is missing bounds validation on the length of DHCP option data relative to the actual received packet size. The parser trusts option length fields inside the response and copies or references memory using those lengths without verifying that the referenced region falls within the packet boundary. See the Schutzwerk Security Advisory for the detailed technical breakdown.

Attack Vector

Exploitation requires only local network access. An attacker either operates a rogue DHCP server or races the legitimate server with a crafted response while the target device performs network boot. No credentials, prior compromise, or user interaction are required. Details of the disclosure are available in the Full Disclosure August Analysis.

No verified public proof-of-concept code is available at the time of writing. Readers should consult the vendor advisory for the reproduction methodology.

Detection Methods for CVE-2024-42040

Indicators of Compromise

DHCP OFFER or ACK packets on the local segment containing option length fields that exceed the remaining packet length
Unexpected TFTP requests from embedded devices containing garbled or non-ASCII filename fragments
Boot-time console output showing corrupted hostname, bootfile, or vendor-class strings during network boot

Detection Strategies

Deploy DHCP snooping on managed switches to restrict DHCP server responses to authorized ports only
Inspect DHCP traffic with a network sensor and alert on responses containing option lengths that exceed the encapsulating packet size
Correlate rogue DHCP server appearances with device boot cycles in centralized logs

Monitoring Recommendations

Baseline the set of authorized DHCP servers on each VLAN and alert on any new server MAC or IP responding to BOOTP/DHCP traffic
Monitor TFTP and network boot traffic originating from embedded devices for anomalous filename patterns
Log ARP and DHCP activity during device provisioning windows and review for unexpected sources

How to Mitigate CVE-2024-42040

Immediate Actions Required

Inventory embedded devices, appliances, and IoT hardware that use DENX U-Boot with the BOOTP/DHCP client enabled
Restrict network boot to isolated, trusted provisioning VLANs and prevent untrusted hosts from sending DHCP responses
Enable DHCP snooping and dynamic ARP inspection on access switches serving devices that perform network boot
Disable network boot entirely on devices that do not require it and use local storage boot instead

Patch Information

DENX maintains U-Boot releases on the GitHub U-Boot Tags page. Device operators should track their vendor's firmware releases for a build that incorporates the upstream fix and deploy the updated bootloader through the appropriate firmware update mechanism. Because U-Boot ships inside vendor firmware, patch availability depends on each device manufacturer rebuilding and redistributing images.

Workarounds

Disable DHCP-based network boot in the U-Boot environment where feasible and use static network configuration
Segment provisioning networks so that only trusted DHCP servers are reachable from devices during boot
Physically or logically isolate devices during initial provisioning to prevent adjacent-network attackers from responding to BOOTP requests

bash

# Example: disable network boot in the U-Boot environment
setenv bootcmd 'run localboot'
setenv ipaddr ''
setenv serverip ''
saveenv