Is CVE-2022-34835 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-34835 being exploited in the wild.

How severe is CVE-2022-34835?

Critical severity, with a CVSS score of 9.8, published 30 June 2022.

Which products and versions are affected?

Denx U-Boot through 2022.07-rc5; Siemens ROX II before 2.17.1.

Is there a fix for CVE-2022-34835?

A patch was published on 2022-06-28: Fix committed to U-Boot source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-34835 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2022-34835?

Check whether you run Denx U-Boot or Siemens ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-34835: Denx Das U-Boot stack buffer overflow in i2c md command

CVE-2022-34835 · Severity: critical · CVSS 9.8 · Published 2022-06-30

Das U-Boot, a widely used bootloader for embedded devices and industrial hardware, contains a vulnerability in its I2C memory display command. An attacker who can control the data returned by an I2C device could potentially crash the system or execute unauthorized code. This could lead to a complete takeover of the affected embedded device, impacting its availability and the integrity of its operations.

Technologies: Denx U-Boot, Siemens ROX II. Vendors: Denx, Siemens.

Quick answers

Is CVE-2022-34835 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-34835 being exploited in the wild.
How severe is CVE-2022-34835?: Critical severity, with a CVSS score of 9.8, published 30 June 2022.
Which products and versions are affected?: Denx U-Boot through 2022.07-rc5; Siemens ROX II before 2.17.1.
Is there a fix for CVE-2022-34835?: A patch was published on 2022-06-28: Fix committed to U-Boot source repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-34835 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2022-34835?: Check whether you run Denx U-Boot or Siemens ROX II at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer signedness error exists in the 'do_i2c_md' function within 'cmd/i2c.c'. When a large length value (e.g., 0x80000100) is provided to the 'i2c md' command, it is treated as a negative number during a bounds check on 32-bit systems. This bypasses the intended limit, causing 'linebytes' to be assigned an excessively large value. Consequently, when 'dm_i2c_read' or 'i2c_read' is called, it attempts to fill a 16-byte stack buffer ('linebuf') with more data than it can hold. If an attacker can control the I2C device's response, they can overwrite the function's return address to achieve arbitrary code execution via Return-Oriented Programming (ROP). The issue was fixed by changing relevant variables to unsigned integer types.

Affected products

Denx U-Boot through 2022.07-rc5
Siemens ROX II family before 2.17.1

Timeline

2022-06-10: disclosed: Vulnerability reported and patch submitted to U-Boot mailing list
2022-06-28: patched: Fix committed to U-Boot source repository
2022-06-30: advisory: NVD publication date
2025-05-01: patched: Debian LTS security update released
2026-05-12: advisory: Siemens advisory SSA-577017 published for Ruggedcom Rox products

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.