Hello dear U-Boot maintainers and developers,

I hope you are all doing well.

During one of our assessments we found a low impact buffer overread vulnerability in the DHCP implementation of U-Boot.

According to the policy of the project [0] the attached vulnerability advisory is hereby disclosed to the public mailing list and the according maintainers.

We will publish the advisory in the next few hours on our website as well. (see links in the advisory)

If you have any questions feel free to contact me.

Best Regards

Simon Diepold

[0]: https://docs.u-boot.org/en/latest/develop/security.html