CVE-2022-2347

2022-09-2313:15:10

CWE-787

CWE-122

[email protected]

web.nvd.nist.gov

uboot

cve-2022-2347

security vulnerability

usb

dfu

heap buffer

length field

7.7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

JSON

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.

Affected configurations

Vulners

NVD

Node

ubootubootRange≤2022.07

CPENameOperatorVersion
denx:u-bootdenx u-bootle2022.07

CPE	Name	Operator	Version
denx:u-boot	denx u-boot	le	2022.07

CNA Affected

[
  {
    "product": "Uboot",
    "vendor": "Uboot",
    "versions": [
      {
        "lessThanOrEqual": "2022.07",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]