CVE-2022-2347: Unchecked Download size in Uboot
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-2347?
CVE-2022-2347 is a vulnerability in UBoot that allows a physically attacker to execute arbitrary code or cause a denial of service.
How does CVE-2022-2347 impact UBoot?
CVE-2022-2347 allows a physically attacker to exploit an unchecked length field in UBoot, leading to arbitrary code execution or denial of service.
What is the severity of CVE-2022-2347?
CVE-2022-2347 has a severity rating of 7.1 (high).
How can I fix CVE-2022-2347?
To mitigate CVE-2022-2347, it is recommended to update UBoot to a version beyond 2022.07 or apply any patches provided by the vendor.
Where can I find more information about CVE-2022-2347?
More information about CVE-2022-2347 can be found at the following reference: [seclists.org/oss-sec/2022/q3/41](https://seclists.org/oss-sec/2022/q3/41).