There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
CVSS Details
- CVSS 3.1 Base Score: 7.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-u-boot | Mar 21, 2024 | Jul 7, 2022 | |
| Debian | debian-upgrade-u-boot | Jul 30, 2024 | Sep 23, 2022 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-uboot-tools-help | Nov 11, 2024 | Sep 23, 2022 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-uboot-tools-help | Jan 15, 2025 | Sep 23, 2022 | |
| Ubuntu | ubuntu-upgrade-u-bootubuntu-upgrade-u-boot-amlogicubuntu-upgrade-u-boot-exynosubuntu-upgrade-u-boot-imxubuntu-upgrade-u-boot-microchipubuntu-upgrade-u-boot-mvebuubuntu-upgrade-u-boot-nezhaubuntu-upgrade-u-boot-omapubuntu-upgrade-u-boot-qcomubuntu-upgrade-u-boot-qemuubuntu-upgrade-u-boot-rockchipubuntu-upgrade-u-boot-rpiubuntu-upgrade-u-boot-sifiveubuntu-upgrade-u-boot-stm32ubuntu-upgrade-u-boot-sunxiubuntu-upgrade-u-boot-tegraubuntu-upgrade-u-boot-tools | Dec 7, 2022 | Sep 23, 2022 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Sep 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub