A malicious USB peripheral can make U-Boot read beyond fixed descriptor arrays before the operating system starts.

every source is a publisher ruled unable to originate; not published as a finding

Sources

ResearchU-Boot USB host trusts advertised interface count after parsing fewer interfaces

Copy link

Share this finding

Email Hacker News Reddit Mastodon Bluesky X LinkedIn Facebook Copy link

Read the full daily brief →

Every finding here carries a source that was checked before it published. If something is wrong, write to admin@fullchain.sh — corrections are published on the day they affect.

Saturday, September 5, 2026