Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
On a storage failure U-Boot's lwIP wget receive callback aborts and frees the TCP connection but returns the wrong status code, so the lwIP TCP input path keeps using the freed connection object, a use-after-free reachable from a malicious HTTP server.
TA_FLAG_CONCURRENT is accepted from user TA headers, letting two sessions race on one shared context and free vm_region nodes that are still in use.
// No embargoed advisories.