Executive brief
U-Boot is a bootloader used in many embedded systems to start the operating system. A vulnerability in its USB firmware update (DFU) feature allows a person with physical access to the device to send specially crafted USB packets that can crash the system or potentially take control of it. This could lead to unauthorized access to sensitive data or the installation of malicious firmware on the device.
Technical details
A heap-based buffer overflow exists in the U-Boot USB Device Firmware Update (DFU) implementation within 'drivers/usb/gadget/f_dfu.c'. The 'dfu_handle' function and its state handlers ('state_dfu_idle', 'state_dfu_dnload_idle') fail to validate the 'wLength' field from USB DFU download setup packets against the 4096-byte ('USB_BUFSIZ') heap-allocated request buffer. Additionally, the implementation does not verify the transfer direction bit ('USB_DIR_IN'), allowing an attacker to trigger out-of-bounds writes (download) or out-of-bounds reads (upload). A physical attacker can exploit this to achieve arbitrary code execution or information disclosure. The issue is fixed in U-Boot versions following v2022.07 and addressed in downstream vendor updates like Siemens Ruggedcom Rox V2.17.1.
Affected products
- DENX Software Engineering U-Boot v2012.10-rc1 to v2022.07
- Siemens Ruggedcom Rox II family All versions < V2.17.1
Timeline
- 2022-02-27: other: Initial outreach to vendor
- 2022-07-08: disclosed: Public disclosure via oss-security mailing list
- 2022-09-23: advisory: NVD published CVE-2022-2347
- 2025-05-01: patched: Debian LTS security update released
- 2026-05-12: patched: Siemens Ruggedcom Rox update released