CVE-2022-34835: Buffer Overflow
Published Jun 29, 2022
·Updated
In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the doi2cmd function.
Affected Software
10 affected componentsFixes available
ubuntu/u-boot<2020.10+dfsg-1ubuntu0~18.04.3
2020.10+dfsg-1ubuntu0~18.04.3
ubuntu/u-boot<2021.01+dfsg-3ubuntu0~20.04.5
2021.01+dfsg-3ubuntu0~20.04.5
ubuntu/u-boot<2022.01+dfsg-2ubuntu2.3
2022.01+dfsg-2ubuntu2.3
debian/u-boot<=2019.01+dfsg-7, <=2021.01+dfsg-5
2023.01+dfsg-22024.01+dfsg-12024.01+dfsg-5
DENX U-Boot<2022.07
DENX U-Boot=2022.07-rc1
DENX U-Boot=2022.07-rc2
DENX U-Boot=2022.07-rc3
DENX U-Boot=2022.07-rc4
DENX U-Boot=2022.07-rc5
Remediation
Patch Available
Event History
Jun 29, 2022
CVE Published
via MITRE·11:48 PM
Data Sourced
via MITRE·11:48 PM
Description
Jun 30, 2022
Data Sourced
via NVD·12:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 12, 2024
Data Sourced
via Launchpad·04:02 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2022-34835.
2
What is the severity level of CVE-2022-34835?
CVE-2022-34835 has a severity level of 9.8 (Critical).
3
Which software versions are affected by CVE-2022-34835?
The affected software versions are DENX U-Boot 2022.07, 2022.07-rc1, 2022.07-rc2, 2022.07-rc3, 2022.07-rc4, and 2022.07-rc5.
4
What is the description of CVE-2022-34835?
CVE-2022-34835 is a vulnerability in Das U-Boot that allows for an integer signedness error and stack-based buffer overflow in the "i2c md" command, leading to the corruption of the return address pointer of the do_i2c_md function.
5
How can I fix CVE-2022-34835?
Upgrade to a patched version of DENX U-Boot that includes the fix for CVE-2022-34835.