There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a wLength
greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
{ "binaries": [ { "binary_name": "u-boot", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-amlogic", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-exynos", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-imx", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-mvebu", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-omap", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-qcom", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-qemu", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-rockchip", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-rpi", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-sunxi", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-tegra", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" }, { "binary_name": "u-boot-tools", "binary_version": "2020.10+dfsg-1ubuntu0~18.04.3" } ], "ubuntu_priority": "medium", "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "u-boot", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-amlogic", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-exynos", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-imx", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-mvebu", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-omap", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-qcom", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-qemu", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-rockchip", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-rpi", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-sifive", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-sunxi", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-tegra", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-tools", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" }, { "binary_name": "u-boot-tools-dbgsym", "binary_version": "2021.01+dfsg-3ubuntu0~20.04.5" } ], "ubuntu_priority": "medium", "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "u-boot", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-amlogic", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-amlogic-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-exynos", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-exynos-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-imx", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-imx-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-microchip", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-mvebu", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-omap", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-omap-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-qcom", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-qcom-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-qemu", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-rockchip", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-rockchip-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-rpi", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-rpi-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-sifive", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-sifive-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-sunxi", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-sunxi-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-tegra", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-tools", "binary_version": "2022.01+dfsg-2ubuntu2.3" }, { "binary_name": "u-boot-tools-dbgsym", "binary_version": "2022.01+dfsg-2ubuntu2.3" } ], "ubuntu_priority": "medium", "availability": "No subscription required" }