CVE-2026-33243 Details
Description
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport to 2025.09.3), an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a signed configuration. mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is not part of the hash and could therefore be modified to allow booting different images than those that have been verified. This issue has been patched in barebox versions 2026.03.1 and backported to 2025.09.3.
A vulnerability exists in barebox versions 2016.03.0 prior to 2025.09.3 and 2025.10.0 prior to 2026.03.1, allowing an attacker to manipulate the FIT (Flat Image Tree) signature verification process. When creating a FIT, the 'hashed-nodes' property is used to indicate which nodes were hashed and need verification by the bootloader. However, this property is not included in the hash, leaving it open to modification by an attacker. This manipulation can trick the bootloader into booting unverified images. The vulnerability requires physical or local access to read/write the FIT on the storage medium, potentially compromising the kernel and, depending on the bootloader and system configuration, other critical components such as a hypervisor or trusted services.
Users can update to barebox versions 2025.09.3 or 2026.03.1 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pengutronix barebox | >= 2016.03.0, < 2025.09.3 >= 2025.10.0, < 2026.03.1 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 11, 2026 | Modified Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | CVE Modified | [email protected] |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |