CVE-2026-34960: Pengutronix Barebox DoS Vulnerability

CVE-2026-34960 Overview

CVE-2026-34960 is an out-of-bounds read vulnerability in barebox, a bootloader maintained by Pengutronix. Versions prior to 2026.04.0 fail to validate option pointer bounds during DHCP packet parsing. The flaw resides in the dhcp_message_type() function, which processes DHCP options without verifying that the pointer remains within the received packet boundary. An attacker on the same broadcast domain can transmit a crafted DHCP Offer or ACK packet missing the 0xff end marker, causing the parser to read past valid packet data and crash the device during boot. The weakness is classified under [CWE-125] Out-of-bounds Read.

Critical Impact

Adjacent-network attackers can crash barebox-based embedded systems during DHCP negotiation, disrupting boot processes for affected devices.

Affected Products

• Pengutronix barebox versions prior to 2026.04.0
• Embedded Linux systems using barebox as the primary bootloader
• IoT and industrial devices relying on barebox network boot functionality

Discovery Timeline

• 2026-05-11 - CVE-2026-34960 published to NVD
• 2026-05-16 - Last updated in NVD database

Technical Details for CVE-2026-34960

Vulnerability Analysis

The vulnerability exists in the DHCP client implementation within barebox. When barebox receives a DHCP response, the dhcp_message_type() function iterates over the options section of the packet to identify the message type. The Dynamic Host Configuration Protocol (DHCP) standard requires options to terminate with a 0xff end marker, but the barebox parser trusts the packet contents rather than enforcing the packet length boundary.

When a crafted packet arrives without the terminating marker, the parser advances its pointer past the end of the received buffer. This reads adjacent memory contents that were never part of the DHCP payload. The resulting access can dereference invalid memory and crash the bootloader during the network boot phase.

Because barebox runs before operating system initialization, a crash leaves the device unable to complete boot. Devices configured to network-boot from a Preboot Execution Environment (PXE) infrastructure are continuously exposed during the DHCP handshake.

Root Cause

The root cause is missing bounds validation in dhcp_message_type(). The function does not verify that the options pointer remains within the bounds of the received packet before dereferencing it. The parser relies entirely on the 0xff end marker to halt iteration, allowing attacker-controlled packet structure to drive the read offset.

Attack Vector

Exploitation requires adjacent network access. An attacker on the same broadcast domain as a barebox-based device responds to or forges DHCP Offer or ACK messages. The crafted packet contains valid DHCP option type-length-value entries but omits the required 0xff end marker. When the target processes the packet, the parser reads out of bounds and the bootloader may crash. No authentication or user interaction is required.

No public proof-of-concept exploit is available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detailed analysis is available in the VulnCheck Advisory for Barebox.

Detection Methods for CVE-2026-34960

Indicators of Compromise

• Repeated barebox boot failures or device resets occurring during DHCP DISCOVER/REQUEST phases
• Malformed DHCP Offer or ACK packets on the local broadcast domain missing the 0xff end-of-options marker
• Unexpected DHCP responses originating from non-authorized servers on provisioning VLANs

Detection Strategies

• Capture DHCP traffic on embedded device segments and inspect option blocks for missing 0xff terminators
• Monitor boot telemetry from barebox devices for early-stage crashes that align with DHCP transactions
• Correlate rogue DHCP server alerts with embedded device reboot events to identify targeted attacks

Monitoring Recommendations

• Enable DHCP snooping on switches serving embedded device segments to block unauthorized DHCP responses
• Log all DHCP server activity and alert on responders not matching the authorized server list
• Audit firmware versions across deployed barebox-based fleets to identify systems below 2026.04.0

How to Mitigate CVE-2026-34960

Immediate Actions Required

• Upgrade barebox to version 2026.04.0 or later on all affected devices
• Restrict DHCP services to trusted servers using DHCP snooping and port security on access switches
• Segment embedded device networks to limit broadcast-domain exposure to untrusted hosts

Patch Information

Pengutronix released the fix in barebox 2026.04.0. The patched release adds bounds checks within the DHCP option parser to ensure the options pointer does not advance past the received packet length. See the GitHub Barebox Release v2026.04.0 for release notes and the GitHub Barebox Repository for source code.

Workarounds

• Disable network boot functionality on barebox devices that do not require it
• Deploy DHCP snooping and rogue DHCP detection on Layer 2 segments hosting affected hardware
• Use static IP configuration during the bootloader stage where operationally feasible

# Example: enable DHCP snooping on a Cisco access switch to block rogue DHCP responses
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
 ip dhcp snooping trust
end