CVE-2022-34835: Buffer Overflow

Q: What is the vulnerability ID of this issue?

The vulnerability ID is CVE-2022-34835.

Q: What is the severity level of CVE-2022-34835?

CVE-2022-34835 has a severity level of 9.8 (Critical).

Q: Which software versions are affected by CVE-2022-34835?

The affected software versions are DENX U-Boot 2022.07, 2022.07-rc1, 2022.07-rc2, 2022.07-rc3, 2022.07-rc4, and 2022.07-rc5.

Q: What is the description of CVE-2022-34835?

CVE-2022-34835 is a vulnerability in Das U-Boot that allows for an integer signedness error and stack-based buffer overflow in the "i2c md" command, leading to the corruption of the return address pointer of the do_i2c_md function.

Q: How can I fix CVE-2022-34835?

Upgrade to a patched version of DENX U-Boot that includes the fix for CVE-2022-34835.

Published Jun 29, 2022

Updated

In Das U-Boot through 2022.07-rc5, an integer signedness error and resultant stack-based buffer overflow in the "i2c md" command enables the corruption of the return address pointer of the doi2cmd function.

Affected Software

13 affected componentsFixes available

ubuntu/u-boot<2020.10+dfsg-1ubuntu0~18.04.3

2020.10+dfsg-1ubuntu0~18.04.3

ubuntu/u-boot<2021.01+dfsg-3ubuntu0~20.04.5

2021.01+dfsg-3ubuntu0~20.04.5

ubuntu/u-boot<2022.01+dfsg-2ubuntu2.3

2022.01+dfsg-2ubuntu2.3

DENX U-Boot<2022.07

DENX U-Boot=2022.07-rc1

DENX U-Boot=2022.07-rc2

DENX U-Boot=2022.07-rc3

DENX U-Boot=2022.07-rc4

DENX U-Boot=2022.07-rc5

debian/u-boot<2022.07+dfsg-1

2022.07+dfsg-1

debian/u-boot<2022.07+dfsg-1

2022.07+dfsg-1

debian/u-boot<2022.07+dfsg-1

2022.07+dfsg-1

debian/u-boot

2023.01+dfsg-2+deb12u32025.01-3+deb13u12025.01-3.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/u-boot to a version that resolves this vulnerability.
Fixed in 2020.10+dfsg-1ubuntu0~18.04.3
Upgrade
Upgrade ubuntu/u-boot to a version that resolves this vulnerability.
Fixed in 2021.01+dfsg-3ubuntu0~20.04.5
Upgrade
Upgrade ubuntu/u-boot to a version that resolves this vulnerability.
Fixed in 2022.01+dfsg-2ubuntu2.3
Upgrade
Upgrade debian/u-boot to a version that resolves this vulnerability.
Fixed in 2023.01+dfsg-2+deb12u3Fixed in 2025.01-3+deb13u1Fixed in 2025.01-3.2
Upgrade
Upgrade debian/u-boot to a version that resolves this vulnerability.
Fixed in 2022.07+dfsg-1

Event History

Jun 29, 2022

CVE Published

via MITRE·11:48 PM

Data Sourced

via MITRE·11:48 PM

Description

Jun 30, 2022

Data Sourced

via NVD·12:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·12:15 AM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

USN-5764-1

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4150-1

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID is CVE-2022-34835.

What is the severity level of CVE-2022-34835?

CVE-2022-34835 has a severity level of 9.8 (Critical).

Which software versions are affected by CVE-2022-34835?

The affected software versions are DENX U-Boot 2022.07, 2022.07-rc1, 2022.07-rc2, 2022.07-rc3, 2022.07-rc4, and 2022.07-rc5.

What is the description of CVE-2022-34835?

CVE-2022-34835 is a vulnerability in Das U-Boot that allows for an integer signedness error and stack-based buffer overflow in the "i2c md" command, leading to the corruption of the return address pointer of the do_i2c_md function.

How can I fix CVE-2022-34835?

Upgrade to a patched version of DENX U-Boot that includes the fix for CVE-2022-34835.

CVE-2022-34835: Buffer Overflow

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the vulnerability ID of this issue?

What is the severity level of CVE-2022-34835?

Which software versions are affected by CVE-2022-34835?

What is the description of CVE-2022-34835?

How can I fix CVE-2022-34835?

Company

Resources

Contact