Stack-based buffer overflow in Universal Boot Loader (U-Boot) - CVE-2022-34835

Vulnerability identifier: #VU66594

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-34835

CWE-ID: CWE-121

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in the do_i2c_md() function within the "i2c md" command. An attacker with physical access to device can trigger a stack-based buffer overflow and escalate privileges on the system.

Universal Boot Loader (U-Boot)
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Storage
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
Ubuntu
openEuler
Anolis OS
u-boot-rpi3
u-boot-tools
u-boot-tools-debuginfo
u-boot-rpiarm64
u-boot-rpiarm64-doc
u-boot-xilinxzynqmpgeneric-doc
u-boot-xilinxzynqmpgeneric
uboot-tools-help
uboot-images-armv8
uboot-images-elf
uboot-tools-debuginfo
uboot-tools-debugsource
uboot-tools
u-boot-mvebu (Ubuntu package)
u-boot-exynos (Ubuntu package)
u-boot-rockchip (Ubuntu package)
u-boot-omap (Ubuntu package)
u-boot-qemu (Ubuntu package)
u-boot-qcom (Ubuntu package)
u-boot (Ubuntu package)
u-boot-rpi (Ubuntu package)
u-boot-sunxi (Ubuntu package)
u-boot-amlogic (Ubuntu package)
u-boot-tegra (Ubuntu package)
u-boot-imx (Ubuntu package)
u-boot-tools (Ubuntu package)
u-boot-sifive (Ubuntu package)
u-boot-rock960-rk3399
u-boot-rock960-rk3399-doc
u-boot-rockpro64-rk3399
u-boot-rockpro64-rk3399-doc
u-boot-rpi3-doc
u-boot-rpi4
u-boot-rpi4-doc
u-boot-xilinxzynqmpvirt
u-boot-xilinxzynqmpvirt-doc
u-boot-xilinxzynqmpzcu102rev10
u-boot-xilinxzynqmpzcu102rev10-doc
u-boot-ls1012afrdmqspi
u-boot-khadas-vim
u-boot-khadas-vim-doc
u-boot-khadas-vim2
u-boot-khadas-vim2-doc
u-boot-libretech-ac
u-boot-libretech-ac-doc
u-boot-libretech-cc
u-boot-libretech-cc-doc
u-boot-hikey-doc
u-boot-ls1012afrdmqspi-doc
u-boot-mvebudb-88f3720
u-boot-mvebudb-88f3720-doc
u-boot-mvebudbarmada8k
u-boot-mvebudbarmada8k-doc
u-boot-mvebuespressobin-88f3720
u-boot-mvebuespressobin-88f3720-doc
u-boot-rock64-rk3328
u-boot-hikey
u-boot-geekbox-doc
u-boot-geekbox
u-boot-firefly-rk3399-doc
u-boot-firefly-rk3399
u-boot-evb-rk3399-doc
u-boot-evb-rk3399
u-boot-dragonboard820c-doc
u-boot-dragonboard820c
u-boot-dragonboard410c-doc
u-boot-dragonboard410c
u-boot-bananapim64-doc
u-boot-bananapim64
u-boot-avnetultra96rev1-doc
u-boot-avnetultra96rev1
u-boot-pineh64-doc
u-boot-p3450-0000-doc
u-boot-pine64plus
u-boot-pine64plus-doc
u-boot-pinebook
u-boot-pinebook-doc
u-boot-pinebook-pro-rk3399
u-boot-pinebook-pro-rk3399-doc
u-boot-pineh64
u-boot-mvebumcbin-88f8040-doc
u-boot-pinephone
u-boot-pinephone-doc
u-boot-poplar
u-boot-poplar-doc
u-boot-rock-pi-4-rk3399
u-boot-rock-pi-4-rk3399-doc
u-boot-rock64-rk3328-doc
u-boot-p2771-0000-500-doc
u-boot-p3450-0000
u-boot-mvebumcbin-88f8040
u-boot-nanopia64
u-boot-nanopia64-doc
u-boot-odroid-c2
u-boot-odroid-c2-doc
u-boot-odroid-c4
u-boot-odroid-c4-doc
u-boot-odroid-n2-doc
u-boot-orangepipc2
u-boot-orangepipc2-doc
u-boot-p2371-2180
u-boot-p2371-2180-doc
u-boot-p2771-0000-500
u-boot-odroid-n2
u-boot-rock-pi-n10-rk3399pro-doc
u-boot-rock-pi-n10-rk3399pro
u-boot-microchip (Ubuntu package)
uboot-tools-doc
u-boot-stm32 (Ubuntu package)

Install updates from vendor's website.

Universal Boot Loader (U-Boot) - update to 2022.07
u-boot-rpi3 - addressed in versions 2018.03-4.9.1, 2018.03-150000.4.11.1, 2019.01-5.11.1, 2019.01-150100.7.16.1, 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-tools - addressed in versions 2018.03-4.9.1, 2018.03-150000.4.11.1, 2019.01-5.11.1, 2019.01-150100.7.16.1, 2020.01-150200.10.15.1, 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-tools-debuginfo - addressed in versions 2018.03-4.9.1, 2018.03-150000.4.11.1, 2019.01-5.11.1, 2019.01-150100.7.16.1, 2020.01-150200.10.15.1, 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpiarm64 - addressed in versions 2020.01-150200.10.15.1, 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpiarm64-doc - addressed in versions 2020.01-150200.10.15.1, 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpgeneric-doc - update to 2020.01-150200.10.15.1
u-boot-xilinxzynqmpgeneric - update to 2020.01-150200.10.15.1
uboot-tools-help - update to 2020.07-6
uboot-images-armv8 - update to 2020.07-6
uboot-images-elf - update to 2020.07-6
uboot-tools-debuginfo - update to 2020.07-6
uboot-tools-debugsource - update to 2020.07-6
uboot-tools - update to 2020.07-6
u-boot-mvebu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-exynos (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rockchip (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-omap (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-qemu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-qcom (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rpi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sunxi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-amlogic (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-tegra (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-imx (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-tools (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sifive (Ubuntu package) - addressed in versions 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rock960-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock960-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rockpro64-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rockpro64-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpi3-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpi4 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpi4-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpvirt - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpvirt-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpzcu102rev10 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpzcu102rev10-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-ls1012afrdmqspi - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-khadas-vim - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-khadas-vim-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-khadas-vim2 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-khadas-vim2-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-libretech-ac - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-libretech-ac-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-libretech-cc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-libretech-cc-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-hikey-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-ls1012afrdmqspi-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebudb-88f3720 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebudb-88f3720-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebudbarmada8k - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebudbarmada8k-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebuespressobin-88f3720 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebuespressobin-88f3720-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock64-rk3328 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-hikey - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-geekbox-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-geekbox - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-firefly-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-firefly-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-evb-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-evb-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-dragonboard820c-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-dragonboard820c - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-dragonboard410c-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-dragonboard410c - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-bananapim64-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-bananapim64 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-avnetultra96rev1-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-avnetultra96rev1 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pineh64-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p3450-0000-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pine64plus - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pine64plus-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinebook - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinebook-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinebook-pro-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinebook-pro-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pineh64 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebumcbin-88f8040-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinephone - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinephone-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-poplar - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-poplar-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock-pi-4-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock-pi-4-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock64-rk3328-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p2771-0000-500-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p3450-0000 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebumcbin-88f8040 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-nanopia64 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-nanopia64-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-c2 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-c2-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-c4 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-c4-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-n2-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-orangepipc2 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-orangepipc2-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p2371-2180 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p2371-2180-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p2771-0000-500 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-n2 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock-pi-n10-rk3399pro-doc - update to 2021.10-150400.4.8.1
u-boot-rock-pi-n10-rk3399pro - update to 2021.10-150400.4.8.1
u-boot-microchip (Ubuntu package) - addressed in versions 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
uboot-tools-doc - update to 2022.04-4
uboot-tools - update to 2022.04-4
uboot-images-armv8 - update to 2022.04-4
u-boot-stm32 (Ubuntu package) - update to 2022.07+dfsg-1ubuntu4.2

• https://source.denx.de/u-boot/u-boot/-/commit/8f8c04bf1ebbd2f72f1643e7ad9617dafa6e5409
• https://lists.denx.de/pipermail/u-boot/2022-June/486113.html
• https://github.com/u-boot/u-boot/commit/8f8c04bf1ebbd2f72f1643e7ad9617dafa6e5409

• Privilege escalation in U-Boot
• SUSE update for u-boot
• SUSE update for u-boot
• SUSE update for u-boot
• SUSE update for u-boot
• SUSE update for u-boot
• SUSE update for u-boot
• Ubuntu update for u-boot
• SUSE update for u-boot
• openEuler update for uboot-tools
• Anolis OS update for uboot-tools