CVE-2022-2347
HighSummary
There exists an unchecked length field in U-Boot that can lead to memory corruption. The DFU implementation in U-Boot does not bound the length field in USB DFU download setup packets, allowing an attacker to send a packet with a length greater than 4096 bytes.
Risk Assessment
A physical attacker can exploit this vulnerability to overwrite memory, potentially leading to unauthorized access or system instability. This risk may affect the integrity and availability of devices using U-Boot.
Recommendation
It is recommended to update U-Boot to the latest version that implements proper bounds for the length field in USB DFU packets. Additionally, consider implementing physical security measures to restrict access to devices.
Other vulnerabilities in U-Boot
See all- CVE-2025-70290Critical
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.
- CVE-2025-70293Low risk· EPSS 7%
An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability exists in function ext4fs_get_bgdtable, the size calculation can lead to under allocation and this underallocated buffer will be used in memcpy() which could lead to arbitrary code execution, a denial of service, or other unspecified impacts.
- CVE-2026-29009High
U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets without cumulative length validation.
- CVE-2026-29008High
Vulnerability in U-Boot up to version 2026.04-rc3 in the tcp_rx_state_machine() function in net/tcp.c. Sending a crafted TCP SYN+ACK packet with a manipulated data offset field causes an integer underflow, leading to bootloader crash and potential memory corruption.
- CVE-2026-29007Medium
In U-Boot through 2026.04-rc3, an out-of-bounds read vulnerability exists in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled. A remote attacker can craft a malicious packet with mismatched IP total length and TCP data offset field, causing reads beyond TCP segment boundaries and potentially disrupting connection state.
- CVE-2026-36175Medium
An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the boot sequence and injecting a crafted string into the kernel boot arguments.
Original NVD description (English source)
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.