SUSE update for u-boot

1) Heap-based buffer overflow

EUVDB-ID: #VU65331

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-33967

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to a defect in the metadata reading process. An attacker with physical access can use a specially crafted squashfs image, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected package u-boot to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Storage: 7.1

SUSE Manager Retail Branch Server: 4.2

SUSE Linux Enterprise Desktop: 15-SP3

openSUSE Leap: 15.3

SUSE Manager Server: 4.2

SUSE Manager Proxy: 4.2

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Server: 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP3

SUSE Linux Enterprise Module for Basesystem: 15-SP3

u-boot-xilinxzynqmpzcu102rev10-doc: before 2021.01-150300.7.15.1

u-boot-xilinxzynqmpzcu102rev10: before 2021.01-150300.7.15.1

u-boot-xilinxzynqmpvirt-doc: before 2021.01-150300.7.15.1

u-boot-xilinxzynqmpvirt: before 2021.01-150300.7.15.1

u-boot-rpiarm64-doc: before 2021.01-150300.7.15.1

u-boot-rpiarm64: before 2021.01-150300.7.15.1

u-boot-rpi4-doc: before 2021.01-150300.7.15.1

u-boot-rpi4: before 2021.01-150300.7.15.1

u-boot-rpi3-doc: before 2021.01-150300.7.15.1

u-boot-rpi3: before 2021.01-150300.7.15.1

u-boot-rockpro64-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-rockpro64-rk3399: before 2021.01-150300.7.15.1

u-boot-rock960-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-rock960-rk3399: before 2021.01-150300.7.15.1

u-boot-rock64-rk3328-doc: before 2021.01-150300.7.15.1

u-boot-rock64-rk3328: before 2021.01-150300.7.15.1

u-boot-rock-pi-4-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-rock-pi-4-rk3399: before 2021.01-150300.7.15.1

u-boot-poplar-doc: before 2021.01-150300.7.15.1

u-boot-poplar: before 2021.01-150300.7.15.1

u-boot-pinephone-doc: before 2021.01-150300.7.15.1

u-boot-pinephone: before 2021.01-150300.7.15.1

u-boot-pineh64-doc: before 2021.01-150300.7.15.1

u-boot-pineh64: before 2021.01-150300.7.15.1

u-boot-pinebook-pro-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-pinebook-pro-rk3399: before 2021.01-150300.7.15.1

u-boot-pinebook-doc: before 2021.01-150300.7.15.1

u-boot-pinebook: before 2021.01-150300.7.15.1

u-boot-pine64plus-doc: before 2021.01-150300.7.15.1

u-boot-pine64plus: before 2021.01-150300.7.15.1

u-boot-p3450-0000-doc: before 2021.01-150300.7.15.1

u-boot-p3450-0000: before 2021.01-150300.7.15.1

u-boot-p2771-0000-500-doc: before 2021.01-150300.7.15.1

u-boot-p2771-0000-500: before 2021.01-150300.7.15.1

u-boot-p2371-2180-doc: before 2021.01-150300.7.15.1

u-boot-p2371-2180: before 2021.01-150300.7.15.1

u-boot-orangepipc2-doc: before 2021.01-150300.7.15.1

u-boot-orangepipc2: before 2021.01-150300.7.15.1

u-boot-odroid-n2-doc: before 2021.01-150300.7.15.1

u-boot-odroid-n2: before 2021.01-150300.7.15.1

u-boot-odroid-c4-doc: before 2021.01-150300.7.15.1

u-boot-odroid-c4: before 2021.01-150300.7.15.1

u-boot-odroid-c2-doc: before 2021.01-150300.7.15.1

u-boot-odroid-c2: before 2021.01-150300.7.15.1

u-boot-nanopia64-doc: before 2021.01-150300.7.15.1

u-boot-nanopia64: before 2021.01-150300.7.15.1

u-boot-mvebumcbin-88f8040-doc: before 2021.01-150300.7.15.1

u-boot-mvebumcbin-88f8040: before 2021.01-150300.7.15.1

u-boot-mvebuespressobin-88f3720-doc: before 2021.01-150300.7.15.1

u-boot-mvebuespressobin-88f3720: before 2021.01-150300.7.15.1

u-boot-mvebudbarmada8k-doc: before 2021.01-150300.7.15.1

u-boot-mvebudbarmada8k: before 2021.01-150300.7.15.1

u-boot-mvebudb-88f3720-doc: before 2021.01-150300.7.15.1

u-boot-mvebudb-88f3720: before 2021.01-150300.7.15.1

u-boot-ls1012afrdmqspi-doc: before 2021.01-150300.7.15.1

u-boot-ls1012afrdmqspi: before 2021.01-150300.7.15.1

u-boot-libretech-cc-doc: before 2021.01-150300.7.15.1

u-boot-libretech-cc: before 2021.01-150300.7.15.1

u-boot-libretech-ac-doc: before 2021.01-150300.7.15.1

u-boot-libretech-ac: before 2021.01-150300.7.15.1

u-boot-khadas-vim2-doc: before 2021.01-150300.7.15.1

u-boot-khadas-vim2: before 2021.01-150300.7.15.1

u-boot-khadas-vim-doc: before 2021.01-150300.7.15.1

u-boot-khadas-vim: before 2021.01-150300.7.15.1

u-boot-hikey-doc: before 2021.01-150300.7.15.1

u-boot-hikey: before 2021.01-150300.7.15.1

u-boot-geekbox-doc: before 2021.01-150300.7.15.1

u-boot-geekbox: before 2021.01-150300.7.15.1

u-boot-firefly-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-firefly-rk3399: before 2021.01-150300.7.15.1

u-boot-evb-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-evb-rk3399: before 2021.01-150300.7.15.1

u-boot-dragonboard820c-doc: before 2021.01-150300.7.15.1

u-boot-dragonboard820c: before 2021.01-150300.7.15.1

u-boot-dragonboard410c-doc: before 2021.01-150300.7.15.1

u-boot-dragonboard410c: before 2021.01-150300.7.15.1

u-boot-bananapim64-doc: before 2021.01-150300.7.15.1

u-boot-bananapim64: before 2021.01-150300.7.15.1

u-boot-avnetultra96rev1-doc: before 2021.01-150300.7.15.1

u-boot-avnetultra96rev1: before 2021.01-150300.7.15.1

u-boot-tools-debuginfo: before 2021.01-150300.7.15.1

u-boot-tools: before 2021.01-150300.7.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222653-1/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU66594

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-34835

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows an attacker to escalate privileges on the system.

The vulnerability exists due to a boundary error in the do_i2c_md() function within the "i2c md" command. An attacker with physical access to device can trigger a stack-based buffer overflow and escalate privileges on the system.

Mitigation

Update the affected package u-boot to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Storage: 7.1

SUSE Manager Retail Branch Server: 4.2

SUSE Linux Enterprise Desktop: 15-SP3

openSUSE Leap: 15.3

SUSE Manager Server: 4.2

SUSE Manager Proxy: 4.2

SUSE Linux Enterprise Server for SAP Applications: 15-SP3

SUSE Linux Enterprise Server: 15-SP3

SUSE Linux Enterprise High Performance Computing: 15-SP3

SUSE Linux Enterprise Module for Basesystem: 15-SP3

u-boot-xilinxzynqmpzcu102rev10-doc: before 2021.01-150300.7.15.1

u-boot-xilinxzynqmpzcu102rev10: before 2021.01-150300.7.15.1

u-boot-xilinxzynqmpvirt-doc: before 2021.01-150300.7.15.1

u-boot-xilinxzynqmpvirt: before 2021.01-150300.7.15.1

u-boot-rpiarm64-doc: before 2021.01-150300.7.15.1

u-boot-rpiarm64: before 2021.01-150300.7.15.1

u-boot-rpi4-doc: before 2021.01-150300.7.15.1

u-boot-rpi4: before 2021.01-150300.7.15.1

u-boot-rpi3-doc: before 2021.01-150300.7.15.1

u-boot-rpi3: before 2021.01-150300.7.15.1

u-boot-rockpro64-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-rockpro64-rk3399: before 2021.01-150300.7.15.1

u-boot-rock960-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-rock960-rk3399: before 2021.01-150300.7.15.1

u-boot-rock64-rk3328-doc: before 2021.01-150300.7.15.1

u-boot-rock64-rk3328: before 2021.01-150300.7.15.1

u-boot-rock-pi-4-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-rock-pi-4-rk3399: before 2021.01-150300.7.15.1

u-boot-poplar-doc: before 2021.01-150300.7.15.1

u-boot-poplar: before 2021.01-150300.7.15.1

u-boot-pinephone-doc: before 2021.01-150300.7.15.1

u-boot-pinephone: before 2021.01-150300.7.15.1

u-boot-pineh64-doc: before 2021.01-150300.7.15.1

u-boot-pineh64: before 2021.01-150300.7.15.1

u-boot-pinebook-pro-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-pinebook-pro-rk3399: before 2021.01-150300.7.15.1

u-boot-pinebook-doc: before 2021.01-150300.7.15.1

u-boot-pinebook: before 2021.01-150300.7.15.1

u-boot-pine64plus-doc: before 2021.01-150300.7.15.1

u-boot-pine64plus: before 2021.01-150300.7.15.1

u-boot-p3450-0000-doc: before 2021.01-150300.7.15.1

u-boot-p3450-0000: before 2021.01-150300.7.15.1

u-boot-p2771-0000-500-doc: before 2021.01-150300.7.15.1

u-boot-p2771-0000-500: before 2021.01-150300.7.15.1

u-boot-p2371-2180-doc: before 2021.01-150300.7.15.1

u-boot-p2371-2180: before 2021.01-150300.7.15.1

u-boot-orangepipc2-doc: before 2021.01-150300.7.15.1

u-boot-orangepipc2: before 2021.01-150300.7.15.1

u-boot-odroid-n2-doc: before 2021.01-150300.7.15.1

u-boot-odroid-n2: before 2021.01-150300.7.15.1

u-boot-odroid-c4-doc: before 2021.01-150300.7.15.1

u-boot-odroid-c4: before 2021.01-150300.7.15.1

u-boot-odroid-c2-doc: before 2021.01-150300.7.15.1

u-boot-odroid-c2: before 2021.01-150300.7.15.1

u-boot-nanopia64-doc: before 2021.01-150300.7.15.1

u-boot-nanopia64: before 2021.01-150300.7.15.1

u-boot-mvebumcbin-88f8040-doc: before 2021.01-150300.7.15.1

u-boot-mvebumcbin-88f8040: before 2021.01-150300.7.15.1

u-boot-mvebuespressobin-88f3720-doc: before 2021.01-150300.7.15.1

u-boot-mvebuespressobin-88f3720: before 2021.01-150300.7.15.1

u-boot-mvebudbarmada8k-doc: before 2021.01-150300.7.15.1

u-boot-mvebudbarmada8k: before 2021.01-150300.7.15.1

u-boot-mvebudb-88f3720-doc: before 2021.01-150300.7.15.1

u-boot-mvebudb-88f3720: before 2021.01-150300.7.15.1

u-boot-ls1012afrdmqspi-doc: before 2021.01-150300.7.15.1

u-boot-ls1012afrdmqspi: before 2021.01-150300.7.15.1

u-boot-libretech-cc-doc: before 2021.01-150300.7.15.1

u-boot-libretech-cc: before 2021.01-150300.7.15.1

u-boot-libretech-ac-doc: before 2021.01-150300.7.15.1

u-boot-libretech-ac: before 2021.01-150300.7.15.1

u-boot-khadas-vim2-doc: before 2021.01-150300.7.15.1

u-boot-khadas-vim2: before 2021.01-150300.7.15.1

u-boot-khadas-vim-doc: before 2021.01-150300.7.15.1

u-boot-khadas-vim: before 2021.01-150300.7.15.1

u-boot-hikey-doc: before 2021.01-150300.7.15.1

u-boot-hikey: before 2021.01-150300.7.15.1

u-boot-geekbox-doc: before 2021.01-150300.7.15.1

u-boot-geekbox: before 2021.01-150300.7.15.1

u-boot-firefly-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-firefly-rk3399: before 2021.01-150300.7.15.1

u-boot-evb-rk3399-doc: before 2021.01-150300.7.15.1

u-boot-evb-rk3399: before 2021.01-150300.7.15.1

u-boot-dragonboard820c-doc: before 2021.01-150300.7.15.1

u-boot-dragonboard820c: before 2021.01-150300.7.15.1

u-boot-dragonboard410c-doc: before 2021.01-150300.7.15.1

u-boot-dragonboard410c: before 2021.01-150300.7.15.1

u-boot-bananapim64-doc: before 2021.01-150300.7.15.1

u-boot-bananapim64: before 2021.01-150300.7.15.1

u-boot-avnetultra96rev1-doc: before 2021.01-150300.7.15.1

u-boot-avnetultra96rev1: before 2021.01-150300.7.15.1

u-boot-tools-debuginfo: before 2021.01-150300.7.15.1

u-boot-tools: before 2021.01-150300.7.15.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222653-1/

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.