Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2022-2347

Published: 23 September 2022

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.

Priority

Medium

CVSS 3 base score: 7.1

Status

Package Release Status
u-boot
Launchpad, Ubuntu, Debian
bionic
Released (2020.10+dfsg-1ubuntu0~18.04.3)
focal
Released (2021.01+dfsg-3ubuntu0~20.04.5)
impish Ignored
(reached end-of-life)
jammy
Released (2022.01+dfsg-2ubuntu2.3)
kinetic
Released (2022.07+dfsg-1ubuntu4.2)
trusty Does not exist

upstream Needs triage

xenial Needs triage

Patches:
upstream: https://github.com/u-boot/u-boot/commit/fbce985e28eaca3af82afecc11961aadaf971a7e