Junglewise Threat Intelligence

CVE-2022-34835: Denx Das U-Boot stack buffer overflow in i2c md command

CVE-2022-34835 · Severity: critical · CVSS 9.8 · Published 2022-06-30

Executive brief

Das U-Boot, a widely used bootloader for embedded devices and industrial hardware, contains a vulnerability in its I2C memory display command. An attacker who can control the data returned by an I2C device could potentially crash the system or execute unauthorized code. This could lead to a complete takeover of the affected embedded device, impacting its availability and the integrity of its operations.

Technical details

An integer signedness error exists in the 'do_i2c_md' function within 'cmd/i2c.c'. When a large length value (e.g., 0x80000100) is provided to the 'i2c md' command, it is treated as a negative number during a bounds check on 32-bit systems. This bypasses the intended limit, causing 'linebytes' to be assigned an excessively large value. Consequently, when 'dm_i2c_read' or 'i2c_read' is called, it attempts to fill a 16-byte stack buffer ('linebuf') with more data than it can hold. If an attacker can control the I2C device's response, they can overwrite the function's return address to achieve arbitrary code execution via Return-Oriented Programming (ROP). The issue was fixed by changing relevant variables to unsigned integer types.

Affected products

  • Denx U-Boot through 2022.07-rc5
  • Siemens ROX II family before 2.17.1

Timeline

  • 2022-06-10: disclosed: Vulnerability reported and patch submitted to U-Boot mailing list
  • 2022-06-28: patched: Fix committed to U-Boot source repository
  • 2022-06-30: advisory: NVD publication date
  • 2025-05-01: patched: Debian LTS security update released
  • 2026-05-12: advisory: Siemens advisory SSA-577017 published for Ruggedcom Rox products

References

Related threats