Re: [security] Report of possible heap overflow in U-Boot's Android bootmeth before any AVB verification (ANT-2026-ZWED60S8)

[Mattijs Korpershoek <mkorpershoek@kernel.org>]

Hi Arthur,

Thank you for the report.

On Thu, Aug 06, 2026 at 08:52, Simon Glass <sjg@chromium.org> wrote:

> Hi Arthur,
>
> On Thu, 6 Aug 2026 at 06:23, Arthur Chan <arthur.chan@adalogics.com> wrote:
>>
>> Hello U-Boot maintainers,
>>
>> I'd like to report a High-severity security issue in  U-Boot (https://github.com/u-boot/u-boot / https://git.u-boot-project.org/u-boot/u-boot) related to possible heap overflow in U-Boot's Android bootmeth before any AVB verification.
>
> Thanks for the report.
>
>>
>> I have attached 3 files with this email as described below.
>> 1) report.md: A full description of the vulnerability and how to reproduce it, together with suggested fix of the issue.
>> 2) Dockerfile: A Dockerfile for demonstrating the issue.
>> 3) driver.c: Work with the Dockerfile to demonstrate the issue.
>>
>> Attribution
>> -----------
>> Please attribute Claude and Ada Logics. This issue was found by Anthropic from using agents to study security of open source projects, and I am from Ada Logics helping validate the found issues and creating the report manually and notify the maintainers.
>
> If this is a standard text, I suggest '...issues found, manually
> create a report and notify...'.
>
> Are you able to send a patch? Then your attribution will be in the
> source tree :-)

I agree with Simon here.

I also think someone else found a similar fix and proposed a patch
already which is here:

https://lore.kernel.org/all/20260729-b4-android-bootmeth-oob-v1-1-31c3450ae0be@byteray.co.uk/

If you wish to contribute to U-Boot, please apply above patch and let us
know if that patch fixes the issue you've reported.

You can contribute by replying to above email using Tested-by:, for
example.

>
> Also I suggest avoiding HTML in email to the mailing list.

Yes, see:
https://docs.u-boot-project.org/en/latest/develop/sending_patches.html#general-patch-submission-rules

Thanks,
Mattijs

>
>>
>> Disclosure
>> ----------
>> This report follows a 90-day coordinated disclosure deadline. I'm happy to coordinate on the exact timing and to provide any further detail you need.
>>
>> Kind regards,
>> Arthur Chan
>>
>>
>>
>> ADA Logics Ltd is registered in England. No: 11624074.
>> Registered office: 266 Banbury Road, Post Box 292,
>> OX2 7DL, Oxford, Oxfordshire , United Kingdom
>
> Regards,
> Simon