There's A Bug in My Boot Finding Vulnerabilities in U Boot

Bootloaders sit at the base of embedded systems, often lack modern exploit mitigations, and run in routers, medical devices and industrial equipment. Their updates rarely reach deployed hardware, so bugs found early matter. The talk maps U-Boot's attack surface, which centers on file system parsing and its built-in TCP/IP stack, and points to past storage-related CVEs showing recurring off-by-one and integer overflow patterns in symlink and inode handling.

The speaker explains why conventional approaches are costly. Emulation through QEMU or rehosting struggles with peripherals, and hardware-in-the-loop does not scale. Instead, the work mined U-Boot mailing-list patches for overflow fixes that never received a CVE, then used CodeQL-style queries to search for the same pattern still present elsewhere in the code. Local language models were used to generate malformed SquashFS images, checked with GDB and callgrind to confirm the intended code paths were reached. A fuzzing script then produced 100 random images, one of which crashed U-Boot's sandbox build on an ordinary x86 laptop. The same bug reproduced on a BeagleBone Black, and a related crash appeared in another bootloader.

The takeaways are practical: mine patch history for bug patterns, use a native sandbox build with sanitizers for file system parsers, and treat LLMs as helpers for crafting structured malformed inputs when paired with a tight harness. The speaker also notes that the attacker-controlled file system threat model limits some findings.