CVE-2022-2347: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-2347 is a security vulnerability discovered in U-Boot, a popular bootloader for embedded systems. The vulnerability affects versions from v2012.10-rc1 onwards on all systems with CONFIG_DFU_OVER_USB or CONFIG_SPL_DFU enabled. The issue was publicly disclosed on July 8, 2022, by Sultan Qasim Khan from NCC Group (OSS Security).

The vulnerability exists in the U-Boot DFU (Device Firmware Update) implementation, which fails to bound the length field in USB DFU download setup packets and doesn't verify the transfer direction for the specified command. The issue is located in the drivers/usb/gadget/f_dfu.c file, specifically affecting the dfu_handle, state_dfu_idle, state_dfu_dnload_idle, and handle_dnload functions. The vulnerability has a CVSS score of 7.7 (AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) (OSS Security).

When exploited, this vulnerability allows data beyond the heap-allocated req->buf buffer to be corrupted or read by a connected USB host when a device running U-Boot is in DFU mode. This can potentially enable a malicious host to gain code execution on the device running U-Boot or read sensitive data from the device (OSS Security).

The vulnerability can be exploited by a physical attacker who crafts a USB DFU download setup packet with a wLength greater than 4096 bytes, allowing them to write beyond the heap-allocated request buffer. Additionally, it's possible to read the buffer's content and beyond if the direction bit for the setup packet indicates a device-to-host direction (Ubuntu Security).

The recommended mitigation is to limit USB transfer lengths to a maximum of DFU_USB_BUFSIZ before adding them to the endpoint transfer queue in dfu_handle. Additionally, every DFU setup packet handler should verify that the direction bit ctrl->bRequestType & USB_DIR_IN matches the request type. Various Ubuntu versions have released patches, including updates for Ubuntu 22.10, 22.04 LTS, 20.04 LTS, and 18.04 LTS (Ubuntu Security Notice).