USN-5764-1: U-Boot vulnerabilities
It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-2347) Nicolas Bidron and Nicolas Guigo discovered that U-Boot incorrectly handled certain fragmented IP packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-30552, CVE-2022-30790) It was discovered that U-Boot incorrectly handled certain NFS lookup replies. A remote attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-30767) Jincheng Wang discovered that U-Boot incorrectly handled certain SquashFS structures. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-33103) Tatsuhiko Yasumatsu discovered that U-Boot incorrectly handled certain SquashFS structures. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-33967) It was discovered that U-Boot incorrectly handled the i2c command. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-34835)
Affected Software
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-5764-1?
USN-5764-1 has been classified with a high severity due to the potential for denial of service and arbitrary code execution.
How do I fix the vulnerability USN-5764-1?
To address USN-5764-1, upgrade to the fixed version, specifically u-boot version 2022.07+dfsg-1ubuntu4.2 or later.
What products are affected by USN-5764-1?
USN-5764-1 affects various Ubuntu products including 22.10 versions of u-boot, u-boot-rpi, u-boot-sifive, and others.
Who discovered the issues addressed in USN-5764-1?
The vulnerabilities in USN-5764-1 were discovered by researchers Nicolas Bidron and Nicolas Guigo.
What impact does USN-5764-1 potentially have on my system?
If exploited, USN-5764-1 could lead to a crash of U-Boot, causing denial of service or unauthorized code execution.