Description
There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does not verify that the transfer direction corresponds to the specified command. Consequently, if a physical attacker crafts a USB DFU download setup packet with a `wLength` greater than 4096 bytes, they can write beyond the heap-allocated request buffer.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Uboot | Uboot | unspecified – ≤ 2022.07 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | u-boot | 2023.01~rc4+dfsg-2 | — |
| Debian 13 | u-boot | 2023.01~rc4+dfsg-2 | — |
| Debian 12 | u-boot | 2023.01~rc4+dfsg-2 | — |
| Debian 11 | u-boot | 2021.01+dfsg-5+deb11u1 | DLA-4150-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | u-boot-nezha | No fix yet | — |
| Ubuntu 22.04 LTS | u-boot | 2022.01+dfsg-2ubuntu2.3 | USN-5764-1 |
| Ubuntu 22.04 LTS | u-boot-nezha | 2022.04+git20220405.7446a472-0ubuntu0.4 | USN-6523-1 |
| Ubuntu 20.04 LTS | u-boot | 2021.01+dfsg-3ubuntu0~20.04.5 | USN-5764-1 |
| Ubuntu 18.04 LTS | u-boot | 2020.10+dfsg-1ubuntu0~18.04.3 | USN-5764-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | u-boot | No fix yet | — |
Advisories 6
- ICSA-26-134-16 Siemens Ruggedcom Rox CISA ICS & IT advisories · May 14, 2026
- NCSC-2026-0147 Kwetsbaarheden verholpen in Siemens-producten NCSC-NL (Netherlands) · May 13, 2026
- SSA-577017 SSA-577017: Multiple Vulnerabilities in Ruggedcom Rox Before 2.17.1 Siemens ProductCERT · May 12, 2026
- USN-6523-1 u-boot-nezha vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-5764-1 u-boot vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-4150-1 u-boot - security update Debian Security (DSA / DLA) · Mar 9, 2026