PT-2022-21938 · U-Boot+5 · U-Boot+5

Tatsuhiko Yasumatsu · Published 2021-04-07 · Updated 2025-05-01 · CVE-2022-33967

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions U-Boot versions from v2020.10-rc2 to v2022.07-rc5

Description The squashfs filesystem implementation in U-Boot contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. This can be triggered by loading a specially crafted squashfs image, potentially leading to a denial-of-service (DoS) condition or arbitrary code execution.

Recommendations For U-Boot versions from v2020.10-rc2 to v2022.07-rc5, consider disabling the squashfs filesystem implementation until a patch is available to prevent potential exploitation. Restrict access to loading squashfs images to minimize the risk of arbitrary code execution or denial-of-service conditions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2021-1610

ALT-PU-2022-2236

CVE-2022-33967

DLA-4150-1

OESA-2022-1800

OPENSUSE-SU-2022_2653-1

OPENSUSE-SU-2022_2661-1

SUSE-SU-2022:2653-1

SUSE-SU-2022:2661-1

SUSE-SU-2022_2653-1

SUSE-SU-2022_2661-1

USN-5764-1

Affected Products

Alt Linux

Debian

Linuxmint

Suse

U-Boot

Ubuntu

References · 34

• 🔥 https://lists.denx.de/pipermail/u-boot/2022-June/487467.html · Exploit
• https://ubuntu.com/security/notices/USN-5764-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33967 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-33967 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30767 · Vendor Advisory
• https://source.denx.de/u-boot/u-boot/-/commit/7f7fb9937c6cb49dd35153bd6708872b390b0a44 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5764-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-30552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33967 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:2661-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2347 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-33967 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1800 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-34835 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4150-1 · Vendor Advisory