ANT-2026-50T0MN89 · uboot

oob-write high

Severity Claude high · Security research firm high · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif.

ANT-2026-50T0MN89: U-Boot EFI Image Loader: Out-of-Bounds Write via Unbounded PE Relocation

A heap out-of-bounds write in U-Boot's EFI image loader. The PE relocation handler in efi_loader_relocate() computes write targets from attacker-controlled VirtualAddress and entry offsets without validating against the allocated image buffer bounds. A crafted EFI binary with SizeOfImage=0 and relocation entries at large RVAs writes ~20MB past the allocation, corrupting heap metadata and ultimately redirecting control flow. U-Boot runs at the highest privilege level pre-OS, so exploitation yields full platform control.

Target

Project: uboot
Commit: 135bc3756ecb63d7

Technical Details

ASAN: "SEGV on unknown address 0x0001deadbeef (pc 0x0001deadbeef ...) Hint: PC is at a non-executable region. Maybe a wild jump?" — the root cause is that efi_loader_relocate() trusts the PE header's SizeOfImage and the .reloc block's VirtualAddress/entry offsets without verifying that the derived pointer falls within [efi_reloc, efi_reloc + SizeOfImage). With SizeOfImage=0 and a large VirtualAddress, the DIR64 fixup *x64 += delta writes 8 bytes far outside the buffer, corrupting adjacent heap memory and ultimately a function pointer.

Crash trace (truncated — full trace in attached crash.log):

INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 416576577
INFO: Loaded 1 modules   (113100 inline 8-bit counters): 113100 [0x55f64549ff20, 0x55f6454bb8ec), 
INFO: Loaded 1 PC tables (113100 PCs): 113100 [0x55f6454bb8f0,0x55f6456755b0), 
/out/fuzz_efi_load_image: Running 1 inputs 1 time(s) each.
Running: /tmp/poc
AddressSanitizer:DEADLYSIGNAL
EXIT_CODE:139
/bin/bash: line 1:    25 Segmentation fault      ASAN_OPTIONS="${ASAN_OPTIONS:+$ASAN_OPTIONS:}log_path=/tmp/.asan_XXXXXXXX" timeout -s SIGKILL 100 /out/fuzz_efi_load_image /tmp/poc 2>&1


=== ASAN Report ===
=================================================================
==26==ERROR: AddressSanitizer: SEGV on unknown address 0x0001deadbeef (pc 0x0001deadbeef bp 0x74e08969e750 sp 0x74e08969e638 T2)
==26==The signal is caused by a READ memory access.
==26==Hint: PC is at a non-executable region. Maybe a wild jump?

Reproduction

Reproduce against the commit listed above as described under Technical Details.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-50T0MN89.

Reference: ANT-2026-50T0MN89
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Calif.

Verdict: true positive
Severity: high

TIMELINE

Dates from discovery through public reveal.

2026-03-30 Reported to tracker
2026-05-08 Sent to maintainer
2026-05-09 Maintainer acknowledged
2026-06-06 Patch released
2026-08-17 Publicly revealed

PROVENANCE

SHA-3-512 hash:

e61613e4d8ba7f3efbccea262f6211cc505fdb23b85b340ea4e2395be305420b771b54d0f8f0cf5135ffed94283a6a33700fb2fd0ef433f107b6a34c14ef9743

Committed 2026-05-08 00:08 PT

Revealed 2026-08-17 13:02 PT

Verify (download preimage.json)

Show preimage JSON

{
  "ant_id": "ANT-2026-50T0MN89",
  "bug_class": "Out-of-bounds-write",
  "claude_severity": "high",
  "commit_sha": "135bc3756ecb63d7",
  "created_at": "2026-03-30T23:29:47+00:00",
  "description": "A heap out-of-bounds write in U-Boot's EFI image loader. The PE relocation handler in `efi_loader_relocate()` computes write targets from attacker-controlled `VirtualAddress` and entry offsets without validating against the allocated image buffer bounds. A crafted EFI binary with `SizeOfImage=0` and relocation entries at large RVAs writes ~20MB past the allocation, corrupting heap metadata and ultimately redirecting control flow. U-Boot runs at the highest privilege level pre-OS, so exploitation yields full platform control.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": "865c8248b8c15154af0ddd5b419356b046bf31b3e9103eeefe1affcd87ee9c47",
  "preimage_version": 1,
  "project": "uboot",
  "reproduction": null,
  "technical_details": "ASAN: \"SEGV on unknown address 0x0001deadbeef (pc 0x0001deadbeef ...) Hint: PC is at a non-executable region. Maybe a wild jump?\" — the root cause is that efi_loader_relocate() trusts the PE header's SizeOfImage and the .reloc block's VirtualAddress/entry offsets without verifying that the derived pointer falls within [efi_reloc, efi_reloc + SizeOfImage). With SizeOfImage=0 and a large VirtualAddress, the DIR64 fixup *x64 += delta writes 8 bytes far outside the buffer, corrupting adjacent heap memory and ultimately a function pointer.",
  "title": "U-Boot EFI Image Loader: Out-of-Bounds Write via Unbounded PE Relocation",
  "vendor_severity": "high"
}