Buffer overflow in Denx U-Boot
CVE-2022-2347
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.006 (45.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 45th percentile — 45.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: -0.000
Affected products
- Denx U-Boot
- Uboot — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- seclists.org/oss-sec/2022/q3/41 (Exploit, Mailing List, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108
- 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
Frequently asked questions
- What is CVE-2022-2347?
- CVE-2022-2347 is a high-severity vulnerability in Denx U-Boot, classified under Heap-based Buffer Overflow. CVSS score: 7.7/10. Published 2022-09-23.
- How severe is CVE-2022-2347?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2022-2347 known to be exploited?
- 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.