Buffer overflow in Universal Boot Loader (U-Boot) - CVE-2022-30767

Vulnerability identifier: #VU64420

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30767

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the nfs_lookup_reply() function in net/nfs.c. A remote attacker can pass specially crafted data to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability exists due to incomplete fix for CVE-2019-14196.

Universal Boot Loader (U-Boot)
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Server
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server for SAP Applications
openSUSE Leap
Ubuntu
openEuler
Fedora
SIMATIC MV560 X
SIMATIC MV560 U
SIMATIC MV550 S
SIMATIC MV550 H
SIMATIC MV540 S
SIMATIC MV540 H
u-boot-tools
u-boot-rpi3
u-boot-tools-debuginfo
uboot-tools
uboot-tools-debugsource
uboot-images-elf
uboot-tools-debuginfo
uboot-images-armv8
uboot-tools-help
u-boot-qemu (Ubuntu package)
u-boot-exynos (Ubuntu package)
u-boot-rpi (Ubuntu package)
u-boot-rockchip (Ubuntu package)
u-boot-mvebu (Ubuntu package)
u-boot (Ubuntu package)
u-boot-omap (Ubuntu package)
u-boot-tools (Ubuntu package)
u-boot-qcom (Ubuntu package)
u-boot-sunxi (Ubuntu package)
u-boot-amlogic (Ubuntu package)
u-boot-tegra (Ubuntu package)
u-boot-imx (Ubuntu package)
u-boot-sifive (Ubuntu package)
u-boot-pinephone-doc
u-boot-poplar
u-boot-poplar-doc
u-boot-rock-pi-4-rk3399
u-boot-rock-pi-4-rk3399-doc
u-boot-rock64-rk3328
u-boot-rock64-rk3328-doc
u-boot-rock960-rk3399
u-boot-rock960-rk3399-doc
u-boot-rockpro64-rk3399-doc
u-boot-rpi3-doc
u-boot-rpi4
u-boot-rpi4-doc
u-boot-rpiarm64
u-boot-rpiarm64-doc
u-boot-xilinxzynqmpvirt
u-boot-xilinxzynqmpvirt-doc
u-boot-xilinxzynqmpzcu102rev10
u-boot-xilinxzynqmpzcu102rev10-doc
u-boot-rockpro64-rk3399
u-boot-geekbox
u-boot-mvebudb-88f3720-doc
u-boot-mvebudb-88f3720
u-boot-ls1012afrdmqspi-doc
u-boot-ls1012afrdmqspi
u-boot-libretech-cc-doc
u-boot-libretech-cc
u-boot-libretech-ac-doc
u-boot-libretech-ac
u-boot-khadas-vim2-doc
u-boot-khadas-vim2
u-boot-khadas-vim-doc
u-boot-khadas-vim
u-boot-hikey-doc
u-boot-hikey
u-boot-geekbox-doc
u-boot-pineh64-doc
u-boot-firefly-rk3399-doc
u-boot-firefly-rk3399
u-boot-evb-rk3399-doc
u-boot-evb-rk3399
u-boot-dragonboard820c-doc
u-boot-dragonboard820c
u-boot-dragonboard410c-doc
u-boot-dragonboard410c
u-boot-bananapim64-doc
u-boot-bananapim64
u-boot-avnetultra96rev1-doc
u-boot-avnetultra96rev1
u-boot-mvebudbarmada8k-doc
u-boot-pinephone
u-boot-pineh64
u-boot-pinebook-pro-rk3399-doc
u-boot-pinebook-pro-rk3399
u-boot-pinebook-doc
u-boot-pinebook
u-boot-pine64plus-doc
u-boot-pine64plus
u-boot-p3450-0000-doc
u-boot-p3450-0000
u-boot-p2771-0000-500-doc
u-boot-p2771-0000-500
u-boot-p2371-2180-doc
u-boot-p2371-2180
u-boot-orangepipc2
u-boot-mvebudbarmada8k
u-boot-mvebuespressobin-88f3720
u-boot-mvebuespressobin-88f3720-doc
u-boot-mvebumcbin-88f8040
u-boot-mvebumcbin-88f8040-doc
u-boot-nanopia64
u-boot-nanopia64-doc
u-boot-odroid-c2-doc
u-boot-orangepipc2-doc
u-boot-odroid-c4
u-boot-odroid-c4-doc
u-boot-odroid-n2
u-boot-odroid-n2-doc
u-boot-odroid-c2
u-boot-rock-pi-n10-rk3399pro-doc
u-boot-rock-pi-n10-rk3399pro
u-boot-microchip (Ubuntu package)
u-boot-stm32 (Ubuntu package)

Install updates from vendor's website.

Universal Boot Loader (U-Boot) - update to 2022.07 rc3
SIMATIC MV560 X - update to 3.3.4
SIMATIC MV560 U - update to 3.3.4
SIMATIC MV550 S - update to 3.3.4
SIMATIC MV550 H - update to 3.3.4
SIMATIC MV540 S - update to 3.3.4
SIMATIC MV540 H - update to 3.3.4
u-boot-tools - addressed in versions 2019.01-5.8.1, 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rpi3 - addressed in versions 2019.01-5.8.1, 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-tools-debuginfo - addressed in versions 2019.01-5.8.1, 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
uboot-tools - update to 2020.07-7
uboot-tools-debugsource - update to 2020.07-7
uboot-images-elf - update to 2020.07-7
uboot-tools-debuginfo - update to 2020.07-7
uboot-images-armv8 - update to 2020.07-7
uboot-tools-help - update to 2020.07-7
u-boot-qemu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-exynos (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rpi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rockchip (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-mvebu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-omap (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-tools (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-qcom (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sunxi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-amlogic (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-tegra (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-imx (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sifive (Ubuntu package) - addressed in versions 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-pinephone-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-poplar - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-poplar-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rock-pi-4-rk3399 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rock-pi-4-rk3399-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rock64-rk3328 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rock64-rk3328-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rock960-rk3399 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rock960-rk3399-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rockpro64-rk3399-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rpi3-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rpi4 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rpi4-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rpiarm64 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rpiarm64-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-xilinxzynqmpvirt - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-xilinxzynqmpvirt-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-xilinxzynqmpzcu102rev10 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-xilinxzynqmpzcu102rev10-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rockpro64-rk3399 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-geekbox - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-mvebudb-88f3720-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-mvebudb-88f3720 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-ls1012afrdmqspi-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-ls1012afrdmqspi - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-libretech-cc-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-libretech-cc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-libretech-ac-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-libretech-ac - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-khadas-vim2-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-khadas-vim2 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-khadas-vim-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-khadas-vim - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-hikey-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-hikey - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-geekbox-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pineh64-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-firefly-rk3399-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-firefly-rk3399 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-evb-rk3399-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-evb-rk3399 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-dragonboard820c-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-dragonboard820c - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-dragonboard410c-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-dragonboard410c - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-bananapim64-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-bananapim64 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-avnetultra96rev1-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-avnetultra96rev1 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-mvebudbarmada8k-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pinephone - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pineh64 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pinebook-pro-rk3399-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pinebook-pro-rk3399 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pinebook-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pinebook - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pine64plus-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-pine64plus - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-p3450-0000-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-p3450-0000 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-p2771-0000-500-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-p2771-0000-500 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-p2371-2180-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-p2371-2180 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-orangepipc2 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-mvebudbarmada8k - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-mvebuespressobin-88f3720 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-mvebuespressobin-88f3720-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-mvebumcbin-88f8040 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-mvebumcbin-88f8040-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-nanopia64 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-nanopia64-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-odroid-c2-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-orangepipc2-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-odroid-c4 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-odroid-c4-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-odroid-n2 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-odroid-n2-doc - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-odroid-c2 - addressed in versions 2021.01-150300.7.12.1, 2021.10-150400.4.5.1
u-boot-rock-pi-n10-rk3399pro-doc - update to 2021.10-150400.4.5.1
u-boot-rock-pi-n10-rk3399pro - update to 2021.10-150400.4.5.1
u-boot-microchip (Ubuntu package) - addressed in versions 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
uboot-tools - update to 2022.04-2.fc36
u-boot-stm32 (Ubuntu package) - update to 2022.07+dfsg-1ubuntu4.2

• https://lists.denx.de/pipermail/u-boot/2022-May/483952.html
• https://github.com/u-boot/u-boot/commit/5d14ee4e53a81055d34ba280cb8fd90330f22a96
• https://securitylab.github.com/research/uboot-rce-nfs-vulnerability/

• Remote code execution in U-Boot
• SUSE update for u-boot
• SUSE update for u-boot
• SUSE update for u-boot
• Ubuntu update for u-boot
• Multiple vulnerabilities in Siemens SIMATIC MV500 Devices
• openEuler update for uboot-tools
• Fedora 36 update for uboot-tools