Out-of-bounds write in Universal Boot Loader (U-Boot) - CVE-2022-2347

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU69943

Out-of-bounds write in Universal Boot Loader (U-Boot) - CVE-2022-2347

Published: December 6, 2022


Vulnerability identifier: #VU69943
CSH Severity: Low
CVSS v4: 5.4 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-2347
CWE-ID: CWE-787
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in the U-Boot DFU implementation when processing download setup packets. An attacker with physical access to device can send a USB DFU download setup packet with a `wLength` greater than 4096 bytes, trigger a heap-based buffer overflow and execute arbitrary code on the system.


Affected software

Universal Boot Loader (U-Boot)
Ubuntu
openEuler
Anolis OS
uboot-tools
uboot-images-elf
uboot-tools-debuginfo
uboot-tools-debugsource
uboot-images-armv8
uboot-tools-help
u-boot-qemu (Ubuntu package)
u-boot-tools (Ubuntu package)
u-boot-qcom (Ubuntu package)
u-boot-amlogic (Ubuntu package)
u-boot-imx (Ubuntu package)
u-boot-omap (Ubuntu package)
u-boot-exynos (Ubuntu package)
u-boot-rpi (Ubuntu package)
u-boot-sunxi (Ubuntu package)
u-boot-mvebu (Ubuntu package)
u-boot (Ubuntu package)
u-boot-rockchip (Ubuntu package)
u-boot-tegra (Ubuntu package)
u-boot-sifive (Ubuntu package)
u-boot-microchip (Ubuntu package)
u-boot-nezha (Ubuntu package)
uboot-tools-doc
u-boot-stm32 (Ubuntu package)

How to mitigate CVE-2022-2347

Install updates from vendor's website.

Universal Boot Loader (U-Boot) - update to 2023.01 rc1
uboot-tools - addressed in versions 2020.07-8, 2021.10-8
uboot-images-elf - addressed in versions 2020.07-8, 2021.10-8
uboot-tools-debuginfo - addressed in versions 2020.07-8, 2021.10-8
uboot-tools-debugsource - addressed in versions 2020.07-8, 2021.10-8
uboot-images-armv8 - addressed in versions 2020.07-8, 2021.10-8
uboot-tools-help - addressed in versions 2020.07-8, 2021.10-8
u-boot-qemu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-tools (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-qcom (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-amlogic (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-imx (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-omap (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-exynos (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rpi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sunxi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-mvebu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rockchip (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-tegra (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sifive (Ubuntu package) - addressed in versions 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-microchip (Ubuntu package) - addressed in versions 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-nezha (Ubuntu package) - addressed in versions 2022.04+git20220405.7446a472-0ubuntu0.4, 2022.10-1089-g528ae9bc6c-0ubuntu1.23.04.2
uboot-tools-doc - update to 2022.04-5
uboot-tools - update to 2022.04-5
uboot-images-armv8 - update to 2022.04-5
u-boot-stm32 (Ubuntu package) - update to 2022.07+dfsg-1ubuntu4.2

External References

Related Security Bulletins