CVE-2022-2347 HIGH

CVE-2022-2347: Unchecked Download size in Uboot

Vendor Uboot
Product Uboot
Weakness CWE-122
Published September 23, 2022
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Local
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.

Key dates

02Disclosure timeline

September 23, 2022 CVE published
May 12, 2026 Record updated