There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.

According to the versions of the uboot-tools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    There exists an unchecked length field in UBoot.The U-Boot DFU implementation does not bound the length     field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to     the specified command.Consequently, if a physical attacker crafts a USB DFU download setup packet with a     `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.(CVE-2022-2347)

Tenable has extracted the preceding description block directly from the EulerOS uboot-tools security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the uboot-tools package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    There exists an unchecked length field in UBoot.The U-Boot DFU implementation does not bound the length     field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to     the specified command.Consequently, if a physical attacker crafts a USB DFU download setup packet with a     `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.(CVE-2022-2347)

Tenable has extracted the preceding description block directly from the EulerOS uboot-tools security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the u package has been released.

The remote Ubuntu 22.04 LTS / 23.04 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6523-1 advisory.

    It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker     could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2022-2347)

    Nicolas Bidron and Nicolas Guigo discovered that U-Boot incorrectly handled certain fragmented IP packets.
    A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2022-30552, CVE-2022-30790)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5764-1 advisory.

    It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker     could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2022-2347)

    Nicolas Bidron and Nicolas Guigo discovered that U-Boot incorrectly handled certain fragmented IP packets.
    A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or     possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu     22.04 LTS. (CVE-2022-30552, CVE-2022-30790)

    It was discovered that U-Boot incorrectly handled certain NFS lookup replies. A remote attacker could use     this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code.
    This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-30767)

    Jincheng Wang discovered that U-Boot incorrectly handled certain SquashFS structures. A local attacker     could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
    (CVE-2022-33103)

    Tatsuhiko Yasumatsu discovered that U-Boot incorrectly handled certain SquashFS structures. A local     attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
    (CVE-2022-33967)

    It was discovered that U-Boot incorrectly handled the i2c command. A local attacker could use this issue     to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue     only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-34835)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210679	EulerOS 2.0 SP10 : uboot-tools (EulerOS-SA-2024-2896)	Nessus	Huawei Local Security Checks	high
210650	EulerOS 2.0 SP10 : uboot-tools (EulerOS-SA-2024-2916)	Nessus	Huawei Local Security Checks	high
203985	Photon OS 3.0: U PHSA-2023-3.0-0528	Nessus	PhotonOS Local Security Checks	high
203414	Photon OS 4.0: U PHSA-2023-4.0-0329	Nessus	PhotonOS Local Security Checks	high
186443	Ubuntu 22.04 LTS / 23.04 : u-boot-nezha vulnerability (USN-6523-1)	Nessus	Ubuntu Local Security Checks	high
168465	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : U-Boot vulnerabilities (USN-5764-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2022-2347

high

Tenable Plugins

high

high

high

high

high

critical