CVE-2022-2347
Fixed in a distro release EPSS <1%CVSS 7.7
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
Products: Uboot, Siemens RUGGEDCOM ROX MX5000, Siemens RUGGEDCOM ROX MX5000RE, Siemens RUGGEDCOM ROX RX1400, Siemens RUGGEDCOM ROX RX1500, Siemens RUGGEDCOM ROX RX1501, Siemens RUGGEDCOM ROX RX1510, Siemens RUGGEDCOM ROX RX1511, Siemens RUGGEDCOM ROX RX1512, Siemens RUGGEDCOM ROX RX1524, Siemens RUGGEDCOM ROX RX1536, Siemens RUGGEDCOM ROX RX5000
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | u-boot | 2021.01+dfsg-5+deb11u1 |
| Debian 12 | u-boot | 2023.01~rc4+dfsg-2 |
| Debian 13 | u-boot | 2023.01~rc4+dfsg-2 |
| Debian 14 | u-boot | 2023.01~rc4+dfsg-2 |
| Ubuntu 18.04 LTS | u-boot | 2020.10+dfsg-1ubuntu0~18.04.3 |
| Ubuntu 20.04 LTS | u-boot | 2021.01+dfsg-3ubuntu0~20.04.5 |
| Ubuntu 22.04 LTS | u-boot | 2022.01+dfsg-2ubuntu2.3 |
| Ubuntu 22.04 LTS | u-boot-nezha | 2022.04+git20220405.7446a472-0ubuntu0.4 |
| Ubuntu 24.04 LTS | u-boot-nezha | no fix |
| Ubuntu Pro 16.04 LTS | u-boot | no fix |