CVE-2025-24857

Description

Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code.

CVSS Details

CVSS Score

7.6

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:h:qualcomm:ipq4019:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:qualcomm:ipq5018:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:qualcomm:ipq5322:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:qualcomm:ipq6018:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:h:qualcomm:ipq8064:-:*:*:*:*:*:*:* - NOT VULNERABLE

U-Boot < 2017.11

Qualcomm IPQ4019 (all versions)

Qualcomm IPQ5018 (all versions)

Qualcomm IPQ5322 (all versions)

Qualcomm IPQ6018 (all versions)

Qualcomm IPQ8064 (all versions)

Qualcomm IPQ8074 (all versions)

Qualcomm IPQ9574 (all versions)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-24857 PoC - Physical Access Memory Dump
// Note: This requires physical access to the target device

#include <stdio.h>
#include <stdint.h>

// Simulated U-Boot memory access demonstration
void * volatile_boot_code_addr = (void *)0x80000000;

int main() {
    printf("CVE-2025-24857 PoC - U-Boot Boot Code Access\n");
    printf("Target: U-Boot < 2017.11, Qualcomm IPQ chips\n\n");
    
    // Step 1: Physical access to device
    printf("[*] Step 1: Obtain physical access to target device\n");
    
    // Step 2: Connect via JTAG/Serial
    printf("[*] Step 2: Connect via JTAG or serial console\n");
    printf("    - Connect to UART pins (TX, RX, GND)\n");
    printf("    - Configure baud rate (typically 115200)\n");
    
    // Step 3: Access volatile boot memory
    printf("[*] Step 3: Access volatile memory containing boot code\n");
    uint32_t *boot_mem = (uint32_t *)volatile_boot_code_addr;
    printf("    - Boot code location: %p\n", boot_mem);
    printf("    - Reading memory without proper access control...\n");
    
    // Step 4: Dump or inject code
    printf("[*] Step 4: Read/inject arbitrary code\n");
    printf("    - Dump boot code for analysis\n");
    printf("    - Inject malicious payload into boot memory\n");
    
    // Step 5: Execute arbitrary code
    printf("[*] Step 5: Execute arbitrary code\n");
    printf("    - Privilege: Ring 0 (highest)\n");
    printf("    - Result: Full device compromise\n");
    
    printf("\n[!] Mitigation: Upgrade U-Boot to >= 2017.11\n");
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-24857
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-24857
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-24857/
[4] VulDB https://vuldb.com/cve/CVE-2025-24857
[5] https://www.cisa.gov/news-events/ics-advisories/icsa-25-343-01

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-24857", "sourceIdentifier": "[email protected]", "published": "2025-12-10T21:16:03.730", "lastModified": "2026-01-21T19:14:47.067", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322, IPQ6018, IPQ8064, IPQ8074, and IPQ9574 could allow an attacker to execute arbitrary code."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "baseScore": 7.6, "baseSeverity": "HIGH", "attackVector": "PHYSICAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 0.9, "impactScore": 6.0}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*", "versionEndExcluding": "2017.11", "matchCriteriaId": "C4A006C7-7EDF-41A2-9679-24C6F423B9CD"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:ipq4019:-:*:*:*:*:*:*:*", "matchCriteriaId": "AA679375-BB14-4B24-8AD9-B2BFBACE2FDB"}, {"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:ipq5018:-:*:*:*:*:*:*:*", "matchCriteriaId": "0E84640A-6848-4C76-96FC-EA349801D440"}, {"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:ipq5322:-:*:*:*:*:*:*:*", "matchCriteriaId": "0674C5CF-5F26-4FB6-9859-B9E730DA3CFC"}, {"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:ipq6018:-:*:*:*:*:*:*:*", "matchCriteriaId": "FDC1ADAD-DA77-47EF-8DB9-C36961C560C2"}, {"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:ipq8064:-:*:*:*:*:*:*:*", "matchCriteriaId": "AC82552A-9E7C-4A13-B7A5-43CEA218675C"}, {"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:ipq8074:-:*:*:*:*:*:*:*", "matchCriteriaId": "2118C404-402F-463C-8160-3CC3B703DF30"}, {"vulnerable": false, "criteria": "cpe:2.3:h:qualcomm:ipq9574:-:*:*:*:*:*:*:*", "matchCriteriaId": "0C866E83-23ED-495C-AA5A-0B01973674BF"}]}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-343-01", "source": "[email protected]", "tags": ["Third Party Advisory", "US Government Resource"]}]}}