Heap-based buffer overflow in Universal Boot Loader (U-Boot) - CVE-2022-33967

Vulnerability identifier: #VU65331

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33967

CWE-ID: CWE-122

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to execute arbitrary code on the target system.

The vulnerability exists due to a defect in the metadata reading process. An attacker with physical access can use a specially crafted squashfs image, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Universal Boot Loader (U-Boot)
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
Anolis OS
u-boot-tegra (Ubuntu package)
u-boot-exynos (Ubuntu package)
u-boot-rockchip (Ubuntu package)
u-boot-mvebu (Ubuntu package)
u-boot-omap (Ubuntu package)
u-boot-qemu (Ubuntu package)
u-boot-qcom (Ubuntu package)
u-boot-sunxi (Ubuntu package)
u-boot-imx (Ubuntu package)
u-boot-tools (Ubuntu package)
u-boot-amlogic (Ubuntu package)
u-boot (Ubuntu package)
u-boot-rpi (Ubuntu package)
u-boot-sifive (Ubuntu package)
u-boot-rock-pi-4-rk3399-doc
u-boot-poplar-doc
u-boot-rock-pi-4-rk3399
u-boot-rock960-rk3399
u-boot-rock64-rk3328
u-boot-rock64-rk3328-doc
u-boot-pinebook-pro-rk3399
u-boot-poplar
u-boot-pinephone-doc
u-boot-pinephone
u-boot-pineh64-doc
u-boot-pineh64
u-boot-pinebook-pro-rk3399-doc
u-boot-tools-debuginfo
u-boot-rock960-rk3399-doc
u-boot-rockpro64-rk3399
u-boot-rockpro64-rk3399-doc
u-boot-rpi3
u-boot-rpi3-doc
u-boot-rpi4
u-boot-rpi4-doc
u-boot-rpiarm64
u-boot-rpiarm64-doc
u-boot-xilinxzynqmpvirt
u-boot-xilinxzynqmpvirt-doc
u-boot-xilinxzynqmpzcu102rev10
u-boot-xilinxzynqmpzcu102rev10-doc
u-boot-tools
u-boot-geekbox-doc
u-boot-mvebudb-88f3720
u-boot-ls1012afrdmqspi-doc
u-boot-ls1012afrdmqspi
u-boot-libretech-cc-doc
u-boot-libretech-cc
u-boot-libretech-ac-doc
u-boot-libretech-ac
u-boot-khadas-vim2-doc
u-boot-khadas-vim2
u-boot-khadas-vim-doc
u-boot-khadas-vim
u-boot-hikey-doc
u-boot-hikey
u-boot-pinebook
u-boot-geekbox
u-boot-firefly-rk3399-doc
u-boot-firefly-rk3399
u-boot-evb-rk3399-doc
u-boot-evb-rk3399
u-boot-dragonboard820c-doc
u-boot-dragonboard820c
u-boot-dragonboard410c-doc
u-boot-dragonboard410c
u-boot-bananapim64-doc
u-boot-bananapim64
u-boot-avnetultra96rev1-doc
u-boot-avnetultra96rev1
u-boot-nanopia64
u-boot-p2771-0000-500-doc
u-boot-p2771-0000-500
u-boot-p2371-2180-doc
u-boot-p2371-2180
u-boot-orangepipc2-doc
u-boot-orangepipc2
u-boot-odroid-n2-doc
u-boot-odroid-n2
u-boot-odroid-c4-doc
u-boot-odroid-c4
u-boot-odroid-c2-doc
u-boot-odroid-c2
u-boot-nanopia64-doc
u-boot-mvebumcbin-88f8040-doc
u-boot-mvebumcbin-88f8040
u-boot-mvebuespressobin-88f3720-doc
u-boot-mvebuespressobin-88f3720
u-boot-mvebudbarmada8k-doc
u-boot-mvebudbarmada8k
u-boot-mvebudb-88f3720-doc
u-boot-p3450-0000
u-boot-p3450-0000-doc
u-boot-pine64plus
u-boot-pine64plus-doc
u-boot-pinebook-doc
uboot-images-elf
uboot-tools
uboot-tools-debugsource
uboot-tools-debuginfo
uboot-tools-help
uboot-images-armv8
u-boot-rock-pi-n10-rk3399pro-doc
u-boot-rock-pi-n10-rk3399pro
u-boot-microchip (Ubuntu package)
uboot-tools-doc
u-boot-stm32 (Ubuntu package)

Install updates from vendor's website.

Universal Boot Loader (U-Boot) - update to 2022.07
u-boot-tegra (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-exynos (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rockchip (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-mvebu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-omap (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-qemu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-qcom (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sunxi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-imx (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-tools (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-amlogic (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rpi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sifive (Ubuntu package) - addressed in versions 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rock-pi-4-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-poplar-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock-pi-4-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock960-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock64-rk3328 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock64-rk3328-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinebook-pro-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-poplar - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinephone-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinephone - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pineh64-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pineh64 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinebook-pro-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-tools-debuginfo - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rock960-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rockpro64-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rockpro64-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpi3 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpi3-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpi4 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpi4-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpiarm64 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-rpiarm64-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpvirt - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpvirt-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpzcu102rev10 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-xilinxzynqmpzcu102rev10-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-tools - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-geekbox-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebudb-88f3720 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-ls1012afrdmqspi-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-ls1012afrdmqspi - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-libretech-cc-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-libretech-cc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-libretech-ac-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-libretech-ac - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-khadas-vim2-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-khadas-vim2 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-khadas-vim-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-khadas-vim - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-hikey-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-hikey - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinebook - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-geekbox - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-firefly-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-firefly-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-evb-rk3399-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-evb-rk3399 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-dragonboard820c-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-dragonboard820c - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-dragonboard410c-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-dragonboard410c - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-bananapim64-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-bananapim64 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-avnetultra96rev1-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-avnetultra96rev1 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-nanopia64 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p2771-0000-500-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p2771-0000-500 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p2371-2180-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p2371-2180 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-orangepipc2-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-orangepipc2 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-n2-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-n2 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-c4-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-c4 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-c2-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-odroid-c2 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-nanopia64-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebumcbin-88f8040-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebumcbin-88f8040 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebuespressobin-88f3720-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebuespressobin-88f3720 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebudbarmada8k-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebudbarmada8k - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-mvebudb-88f3720-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p3450-0000 - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-p3450-0000-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pine64plus - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pine64plus-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
u-boot-pinebook-doc - addressed in versions 2021.01-150300.7.15.1, 2021.10-150400.4.8.1
uboot-images-elf - update to 2021.10-6
uboot-tools - update to 2021.10-6
uboot-tools-debugsource - update to 2021.10-6
uboot-tools-debuginfo - update to 2021.10-6
uboot-tools-help - update to 2021.10-6
uboot-images-armv8 - update to 2021.10-6
u-boot-rock-pi-n10-rk3399pro-doc - update to 2021.10-150400.4.8.1
u-boot-rock-pi-n10-rk3399pro - update to 2021.10-150400.4.8.1
u-boot-microchip (Ubuntu package) - addressed in versions 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
uboot-tools-doc - update to 2022.04-3
uboot-images-armv8 - update to 2022.04-3
uboot-tools - update to 2022.04-3
u-boot-stm32 (Ubuntu package) - update to 2022.07+dfsg-1ubuntu4.2

• https://jvn.jp/en/vu/JVNVU97846460/index.html

• Heap-based buffer overflow in U-Boot
• SUSE update for u-boot
• SUSE update for u-boot
• Ubuntu update for u-boot
• openEuler 22.03 LTS update for uboot-tools
• Anolis OS update for uboot-tools