CVE-2022-33103: High severity DENX U-Boot vulnerability
Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfsreaddir().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/u-bootto a version that resolves this vulnerability.Fixed in 2020.10+dfsg-1ubuntu0~18.04.3 - Upgrade
Upgrade
ubuntu/u-bootto a version that resolves this vulnerability.Fixed in 2021.01+dfsg-3ubuntu0~20.04.5 - Upgrade
Upgrade
ubuntu/u-bootto a version that resolves this vulnerability.Fixed in 2022.01+dfsg-2ubuntu2.3 - Upgrade
Upgrade
debian/u-bootto a version that resolves this vulnerability.Fixed in 2023.01+dfsg-2+deb12u3Fixed in 2025.01-3+deb13u1Fixed in 2025.01-3.2 - Upgrade
Upgrade
debian/u-bootto a version that resolves this vulnerability.Fixed in 2022.07+dfsg-1
Event History
Frequently Asked Questions
What is CVE-2022-33103?
CVE-2022-33103 is a vulnerability in Das U-Boot versions from v2020.10 to v2022.07-rc3 that allows an out-of-bounds write via the sqfs_readdir() function.
What is the severity of CVE-2022-33103?
The severity of CVE-2022-33103 is high, with a CVSS score of 7.8.
Which software versions are affected by CVE-2022-33103?
Das U-Boot versions from v2020.10 to v2022.07-rc3, as well as version 2022.07-rc1, 2022.07-rc2, and 2022.07-rc3, are affected by CVE-2022-33103.
How can I fix CVE-2022-33103?
To fix CVE-2022-33103, it is recommended to update Das U-Boot to a version beyond v2022.07-rc3.
Where can I find more information about CVE-2022-33103?
More information about CVE-2022-33103 can be found at the following references: [Link 1](https://lore.kernel.org/all/20220609140206.297405-1-miquel.raynal@bootlin.com/) and [Link 2](https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com/).