CVE-2022-23005

Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature

HIGH

8.7

CVSS Score

Published: January 23, 2023 at 12:00 AM UTC

Updated: June 17, 2026 at 04:29 AM UTC

1 product affected across 1 vendorUniversal Flash Storage· also runs on 3 platforms

Using NA by NA?

Get instant alerts when new vulnerabilities affect NA - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH8.7

Exploit prediction

EPSS 0.8%

SSVC

PoC

Description

Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where the Host boot ROM code implements the UFS Boot feature to boot from UFS compliant storage devices. The UFS Boot feature, as specified in the UFS standard, is provided by UFS devices to support platforms that need to download the system boot loader from external non-volatile storage locations. Several scenarios have been identified in which adversaries may disable the boot capability, or revert to an old boot loader code, if the host boot ROM code is improperly implemented. UFS Host Boot ROM implementers may be impacted by this vulnerability. UFS devices are only impacted when connected to a vulnerable UFS Host and are not independently impacted by this vulnerability. When present, the vulnerability is in the UFS Host implementation and is not a vulnerability in Western Digital UFS Devices. Western Digital has provided details of the vulnerability to the JEDEC standards body, multiple vendors of host processors, and software solutions providers.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Universal Flash Storage · Jedec

95%

All versions

westerndigital-inand-eu311-mobile-mc-ufs (environment) · westerndigital-inand-eu312-automotive-xa-at-ufs (environment) · westerndigital-inand-eu312-industrial-ix-ufs (environment)