CVE-2022-2347: DENX U-Boot heap buffer overflow in USB DFU implementation

CVE-2022-2347 · Severity: high · CVSS 7.7 · Published 2022-09-23

U-Boot is a bootloader used in many embedded systems to start the operating system. A vulnerability in its USB firmware update (DFU) feature allows a person with physical access to the device to send specially crafted USB packets that can crash the system or potentially take control of it. This could lead to unauthorized access to sensitive data or the installation of malicious firmware on the device.

Technologies: Denx U-Boot, Siemens RUGGEDCOM ROX II. Vendors: Denx, Siemens.

Quick answers

Is CVE-2022-2347 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-2347 being exploited in the wild.
How severe is CVE-2022-2347?
High severity, with a CVSS score of 7.7, published 23 September 2022.
Which products and versions are affected?
Siemens RUGGEDCOM ROX II All versions < V2.17.1.
Is there a fix for CVE-2022-2347?
A patch was published on 2025-05-01: Debian LTS security update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-2347 attacked?
It is attacked with physical access, in an operating system.
Am I affected by CVE-2022-2347?
Check whether you run Denx U-Boot or Siemens RUGGEDCOM ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the U-Boot USB Device Firmware Update (DFU) implementation within 'drivers/usb/gadget/f_dfu.c'. The 'dfu_handle' function and its state handlers ('state_dfu_idle', 'state_dfu_dnload_idle') fail to validate the 'wLength' field from USB DFU download setup packets against the 4096-byte ('USB_BUFSIZ') heap-allocated request buffer. Additionally, the implementation does not verify the transfer direction bit ('USB_DIR_IN'), allowing an attacker to trigger out-of-bounds writes (download) or out-of-bounds reads (upload). A physical attacker can exploit this to achieve arbitrary code execution or information disclosure. The issue is fixed in U-Boot versions following v2022.07 and addressed in downstream vendor updates like Siemens Ruggedcom Rox V2.17.1.

Affected products

  • DENX Software Engineering U-Boot v2012.10-rc1 to v2022.07
  • Siemens Ruggedcom Rox II family All versions < V2.17.1

Timeline

  • 2022-02-27: other: Initial outreach to vendor
  • 2022-07-08: disclosed: Public disclosure via oss-security mailing list
  • 2022-09-23: advisory: NVD published CVE-2022-2347
  • 2025-05-01: patched: Debian LTS security update released
  • 2026-05-12: patched: Siemens Ruggedcom Rox update released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.