CVE-2022-2347

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-234707.5Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gun CVE-2022-234716.5containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the ho CVE-2022-234727.5Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. CVE-2022-234734.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authoriza CVE-2022-234746.1Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The pr CVE-2022-234758.8daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scriptin CVE-2022-234767.5Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return v CVE-2022-234779.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234789.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234799.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234809.8xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.CVE-2022-234819.1xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.