CVE-2019-13103

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-29 · updated 2026-06-17
Weakness: CWE-674

Description

A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data.

Affected products

u-boot: before 2019.04; 2019.04, 2019.04-rc1, 2019.04-rc2, 2019.04-rc3, 2019.04-rc4, 2019.07-rc1 (+3) — fixed in 2019.04

How to fix

Upgrade to a fixed version: u-boot 2019.04. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf
https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75
https://github.com/u-boot/u-boot/commits/master
https://lists.denx.de/pipermail/u-boot/2019-July/375512.html
https://cert-portal.siemens.com/productcert/pdf/ssa-618620.pdf
https://gist.github.com/deephooloovoo/d91b81a1674b4750e662dfae93804d75
https://github.com/u-boot/u-boot/commits/master
https://lists.denx.de/pipermail/u-boot/2019-July/375512.html
https://cert-portal.siemens.com/productcert/html/ssa-577017.html
https://cert-portal.siemens.com/productcert/html/ssa-618620.html

Get alerted when CVE-2019-13103 or the next vulnerability affects your stack