CVE-2022-2347 — Heap-based Buffer Overflow in U-boot

CWE-122 — Heap-based Buffer OverflowCWE-787 — Out-of-bounds Write8 documents5 sources
Severity
7.1HIGHNVD
EPSS
0.0%
top 89.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Denx U-bootDebian U-bootUboot
Timeline
PublishedSep 23
Latest updateNov 29

Description

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.

CVSS vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 0.5 | Impact: 6.0

Affected Packages5 packages

▶CVEListV5uboot/ubootunspecified — 2022.07
▶debiandebian/u-boot< u-boot 2023.01~rc4+dfsg-2 (bookworm)
▶Debiandenx/u-boot< 2021.01+dfsg-5+deb11u1+3
▶Ubuntudenx/u-boot< 2020.10+dfsg-1ubuntu0~18.04.3+2
▶NVDdenx/u-boot2012.10 — 2022.07

🔴Vulnerability Details

4
OSV
u-boot-nezha vulnerability↗2023-11-29
▶
OSV
u-boot vulnerabilities↗2022-12-06
▶
GHSA
GHSA-57ww-qgjv-3g3c: There exists an unchecked length field in UBoot↗2022-09-25
▶
OSV
CVE-2022-2347: There exists an unchecked length field in UBoot↗2022-09-23
▶

📋Vendor Advisories

3
Ubuntu
u-boot-nezha vulnerability↗2023-11-29
▶
Ubuntu
U-Boot vulnerabilities↗2022-12-06
▶
Debian
CVE-2022-2347: u-boot - There exists an unchecked length field in UBoot. The U-Boot DFU implementation d...↗2022
▶