PT-2022-16011 · U-Boot+4 · U-Boot+4

Sultan Qasim Khan · Published 2022-02-27 · Updated 2025-05-01 · CVE-2022-2347

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UBoot (affected versions not specified)

Description The issue is related to an unchecked length field in UBoot's DFU implementation. Specifically, the U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. This allows a physical attacker to craft a USB DFU download setup packet with a wLength greater than 4096 bytes, potentially writing beyond the heap-allocated request buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

ALT-PU-2022-2727

ALT-PU-2023-4892

BDU:2025-13599

CVE-2022-2347

DLA-4150-1

OESA-2024-2186

OESA-2024-2187

OESA-2024-2188

OESA-2024-2189

USN-5764-1

USN-6523-1

Affected Products

Alt Linux

Debian

Linuxmint

U-Boot

Ubuntu

References · 41

• 🔥 https://seclists.org/oss-sec/2022/q3/41 · Exploit
• https://ubuntu.com/security/CVE-2022-30552 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2347 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2347 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2347 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2186 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2188 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-2347 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2347 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-33103 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5764-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30767 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2187 · Vendor Advisory