CVE-2022-33967: Buffer Overflow
Published Jul 20, 2022
·Updated
squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.
Affected Software
32 affected componentsFixes available
ubuntu/u-boot<2020.10+dfsg-1ubuntu0~18.04.3
2020.10+dfsg-1ubuntu0~18.04.3
ubuntu/u-boot<2021.01+dfsg-3ubuntu0~20.04.5
2021.01+dfsg-3ubuntu0~20.04.5
ubuntu/u-boot<2022.01+dfsg-2ubuntu2.3
2022.01+dfsg-2ubuntu2.3
debian/u-boot<=2021.01+dfsg-5
2019.01+dfsg-72023.01+dfsg-22024.01+dfsg-12024.01+dfsg-5
DENX U-Boot=2020.10-rc2
DENX U-Boot=2020.10-rc3
DENX U-Boot=2020.10-rc4
DENX U-Boot=2020.10-rc5
DENX U-Boot=2021.01
DENX U-Boot=2021.01-rc1
DENX U-Boot=2021.01-rc2
DENX U-Boot=2021.01-rc3
DENX U-Boot=2021.01-rc4
DENX U-Boot=2021.01-rc5
DENX U-Boot=2021.04-rc1
DENX U-Boot=2021.04-rc2
DENX U-Boot=2022.01
DENX U-Boot=2022.01-rc1
DENX U-Boot=2022.01-rc2
DENX U-Boot=2022.01-rc3
DENX U-Boot=2022.01-rc4
DENX U-Boot=2022.04
DENX U-Boot=2022.04-rc1
DENX U-Boot=2022.04-rc2
DENX U-Boot=2022.04-rc3
DENX U-Boot=2022.04-rc4
DENX U-Boot=2022.04-rc5
DENX U-Boot=2022.07-rc1
DENX U-Boot=2022.07-rc2
DENX U-Boot=2022.07-rc3
DENX U-Boot=2022.07-rc4
DENX U-Boot=2022.07-rc5
Remediation
Event History
Jul 20, 2022
CVE Published
via Ubuntu·12:00 AM
CVE Published
via MITRE·06:15 AM
Data Sourced
via MITRE·06:15 AM
DescriptionWeakness
Data Sourced
via NVD·07:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 12, 2024
Data Sourced
via Launchpad·04:02 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this squashfs filesystem issue in U-Boot?
The vulnerability ID is CVE-2022-33967.
2
What is the severity level of CVE-2022-33967?
The severity level of CVE-2022-33967 is high.
3
What is the affected software for CVE-2022-33967?
The affected software is DENX U-Boot versions from v2020.10-rc2 to v2022.07-rc5.
4
What is the impact of CVE-2022-33967?
Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.
5
Where can I find more information about CVE-2022-33967?
You can find more information about CVE-2022-33967 on the JVN vulnerability database and the U-Boot mailing list.