CVE-2022-2347
Unchecked Download size in Uboot
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unchecked Download size in Uboot
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
- Record
CVE-2022-2347- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
EUVDEUVD-2022-34616
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
- Record
EUVD-2022-34616- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-57ww-qgjv-3g3c
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the...
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
- Record
GHSA-57ww-qgjv-3g3c- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
NVD
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
- Record
CVE-2022-2347- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-122, CWE-787
- Updated
- 2026-11-02
OSV
Unchecked Download size in Uboot
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
- Record
CVE-2022-2347- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-2347
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
- Record
DEBIAN-CVE-2022-2347- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
Show 7 moreShow less
OSVOESA-2024-2186
uboot-tools security update
This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot's environment.
Security Fix(es):
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.(CVE-2022-2347)
- Record
OESA-2024-2186- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2187
uboot-tools security update
This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot's environment.
Security Fix(es):
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.(CVE-2022-2347)
- Record
OESA-2024-2187- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2188
uboot-tools security update
This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot's environment.
Security Fix(es):
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.(CVE-2022-2347)
- Record
OESA-2024-2188- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-2189
uboot-tools security update
This package includes the mkimage program, which allows generation of U-Boot images in various formats, and the fw_printenv and fw_setenv programs to read and modify U-Boot's environment.
Security Fix(es):
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.(CVE-2022-2347)
- Record
OESA-2024-2189- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-2347
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
- Record
UBUNTU-CVE-2022-2347- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-5764-1 No score
u-boot vulnerabilities
It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-2347)
Nicolas Bidron and Nicolas Guigo discovered that U-Boot incorrectly handled certain fragmented IP packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-30552, CVE-2022-30790)
It was discovered that U-Boot incorrectly handled certain NFS lookup replies. A remote attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-30767)
Jincheng Wang discovered that U-Boot incorrectly handled certain SquashFS structures. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-33103)
Tatsuhiko Yasumatsu discovered that U-Boot incorrectly handled certain SquashFS structures. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-33967)
It was discovered that U-Boot incorrectly handled the i2c command. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-34835)
- Record
USN-5764-1- Updated
- 2026-11-02
OSVUSN-6523-1 No score
u-boot-nezha vulnerability
It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-2347)
Nicolas Bidron and Nicolas Guigo discovered that U-Boot incorrectly handled certain fragmented IP packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-30552, CVE-2022-30790)
- Record
USN-6523-1- Updated
- 2026-11-02
Affected products
- denx u-boot
- uboot
- siemens ruggedcom rox mx5000
- siemens ruggedcom rox mx5000re
- siemens ruggedcom rox rx1400
- siemens ruggedcom rox rx1500
- siemens ruggedcom rox rx1501
- siemens ruggedcom rox rx1510
- siemens ruggedcom rox rx1511
- siemens ruggedcom rox rx1512
- siemens ruggedcom rox rx1524
- siemens ruggedcom rox rx1536
Show 1 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
u-bootDebian:12 |
before 2023.01~rc4+dfsg-2 | 2023.01~rc4+dfsg-2 |
u-bootDebian:13 |
before 2023.01~rc4+dfsg-2 | 2023.01~rc4+dfsg-2 |
u-bootDebian:14 |
before 2023.01~rc4+dfsg-2 | 2023.01~rc4+dfsg-2 |
u-bootDebian:11 |
before 2021.01+dfsg-5+deb11u1, plus listed versions 2021.01+dfsg-5 |
2021.01+dfsg-5+deb11u1 |
uboot-toolsopenEuler:22.03-LTS-SP3 |
before 2021.10-8.oe2203sp3 | 2021.10-8.oe2203sp3 |
uboot-toolsopenEuler:20.03-LTS-SP4 |
before 2020.07-8.oe2003sp4 | 2020.07-8.oe2003sp4 |
uboot-toolsopenEuler:22.03-LTS-SP1 |
before 2021.10-8.oe2203sp1 | 2021.10-8.oe2203sp1 |
uboot-toolsopenEuler:22.03-LTS-SP4 |
before 2021.10-8.oe2203sp4 | 2021.10-8.oe2203sp4 |
u-bootUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2015.04+dfsg1-2ubuntu12015.10+dfsg1-22015.10+dfsg1-32015.10+dfsg1-42016.01+dfsg1-1 Show 7 moreShow less2016.01+dfsg1-1ubuntu12016.01+dfsg1-2ubuntu12016.01+dfsg1-2ubuntu22016.01+dfsg1-2ubuntu32016.01+dfsg1-2ubuntu52016.01+dfsg1-2ubuntu5+esm12016.01+dfsg1-2ubuntu5+esm2 |
None known |
u-bootUbuntu:18.04:LTS |
before 2020.10+dfsg-1ubuntu0~18.04.3, plus listed versions 2016.03+dfsg1-6ubuntu22018.07~rc3+dfsg1-0ubuntu1~18.04.12018.07~rc3+dfsg1-0ubuntu2~18.04.12018.07~rc3+dfsg1-0ubuntu3~18.04.12019.07+dfsg-1ubuntu4~18.04.12020.10+dfsg-1ubuntu0~18.04.2 |
2020.10+dfsg-1ubuntu0~18.04.3 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
u-bootUbuntu:20.04:LTS |
before 2021.01+dfsg-3ubuntu0~20.04.5, plus listed versions 2019.07+dfsg-1ubuntu32019.07+dfsg-1ubuntu52019.07+dfsg-1ubuntu62020.10+dfsg-1ubuntu0~20.04.22021.01+dfsg-3ubuntu0~20.04.12021.01+dfsg-3ubuntu0~20.04.32021.01+dfsg-3ubuntu0~20.04.4 |
2021.01+dfsg-3ubuntu0~20.04.5 |
u-bootUbuntu:22.04:LTS |
before 2022.01+dfsg-2ubuntu2.3, plus listed versions 2021.07+dfsg-0ubuntu82021.07+dfsg-0ubuntu92021.07+dfsg-0ubuntu102022.01+dfsg-2ubuntu12022.01+dfsg-2ubuntu22022.01+dfsg-2ubuntu2.1 |
2022.01+dfsg-2ubuntu2.3 |
u-boot-nezhaUbuntu:22.04:LTS |
before 2022.04+git20220405.7446a472-0ubuntu0.4, plus listed versions 2021.09+git20211008.62392d3-0ubuntu12022.04+git20220405.7446a472-0ubuntu0.12022.04+git20220405.7446a472-0ubuntu0.22022.04+git20220405.7446a472-0ubuntu0.3 |
2022.04+git20220405.7446a472-0ubuntu0.4 |
u-boot-nezhaUbuntu:24.04:LTS |
All versions, plus listed versions 2022.10-1089-g528ae9bc6c-0ubuntu22024.01~rc1-190-g2e89b706f5-0ubuntu12024.01~rc1-190-g2e89b706f5-0ubuntu22024.01~rc1-190-g2e89b706f5-0ubuntu2.24.04.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2347 is a high vulnerability (CVSS 7.7) in Denx U-boot, published September 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 47th percentile. Fixed in u-boot 2023.01~rc4+dfsg-2.
References
seclists.org/oss-sec/2022/q3/41
lists.debian.org/debian-lts-announce/2025/05/msg00001.html
cert-portal.siemens.com/productcert/html/ssa-577017.html
nvd.nist.gov/vuln/detail/CVE-2022-2347
github.com/advisories/GHSA-57ww-qgjv-3g3c
Show 16 moreShow less
security-tracker.debian.org/tracker/CVE-2022-2347
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2024-2186
ubuntu.com/security/CVE-2022-2347
openwall.com/lists/oss-security/2022/07/08/2
cve.org/CVERecord?id=CVE-2022-2347