Out-of-bounds write in Universal Boot Loader (U-Boot) - CVE-2022-33103

Vulnerability identifier: #VU66705

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33103

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a boundary error within the sqfs_readdir() function when reading local directories. A local user can trigger an out-of-bounds write error and execute arbitrary code with elevated privileges.

Universal Boot Loader (U-Boot)
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Desktop
openSUSE Leap
Ubuntu
openEuler
u-boot-tools (Ubuntu package)
u-boot-qcom (Ubuntu package)
u-boot-qemu (Ubuntu package)
u-boot-sunxi (Ubuntu package)
u-boot-tegra (Ubuntu package)
u-boot-omap (Ubuntu package)
u-boot-imx (Ubuntu package)
u-boot-mvebu (Ubuntu package)
u-boot-amlogic (Ubuntu package)
u-boot-rockchip (Ubuntu package)
u-boot-rpi (Ubuntu package)
u-boot (Ubuntu package)
u-boot-exynos (Ubuntu package)
u-boot-sifive (Ubuntu package)
u-boot-rock960-rk3399-doc
u-boot-pinebook-doc
u-boot-rock960-rk3399
u-boot-rock64-rk3328-doc
u-boot-rock64-rk3328
u-boot-rock-pi-4-rk3399-doc
u-boot-rock-pi-4-rk3399
u-boot-poplar-doc
u-boot-poplar
u-boot-pinephone-doc
u-boot-pineh64-doc
u-boot-pineh64
u-boot-pinebook-pro-rk3399-doc
u-boot-pinebook-pro-rk3399
u-boot-rockpro64-rk3399
u-boot-rockpro64-rk3399-doc
u-boot-rpi3
u-boot-rpi3-doc
u-boot-rpi4
u-boot-rpi4-doc
u-boot-rpiarm64
u-boot-rpiarm64-doc
u-boot-xilinxzynqmpvirt
u-boot-xilinxzynqmpvirt-doc
u-boot-xilinxzynqmpzcu102rev10
u-boot-xilinxzynqmpzcu102rev10-doc
u-boot-tools
u-boot-pinephone
u-boot-geekbox
u-boot-ls1012afrdmqspi-doc
u-boot-ls1012afrdmqspi
u-boot-libretech-cc-doc
u-boot-libretech-cc
u-boot-libretech-ac-doc
u-boot-libretech-ac
u-boot-khadas-vim2-doc
u-boot-khadas-vim2
u-boot-khadas-vim-doc
u-boot-khadas-vim
u-boot-hikey-doc
u-boot-hikey
u-boot-geekbox-doc
u-boot-pine64plus-doc
u-boot-firefly-rk3399-doc
u-boot-firefly-rk3399
u-boot-evb-rk3399-doc
u-boot-evb-rk3399
u-boot-dragonboard820c-doc
u-boot-dragonboard820c
u-boot-dragonboard410c-doc
u-boot-dragonboard410c
u-boot-bananapim64-doc
u-boot-bananapim64
u-boot-avnetultra96rev1-doc
u-boot-avnetultra96rev1
u-boot-tools-debuginfo
u-boot-orangepipc2-doc
u-boot-nanopia64-doc
u-boot-odroid-c2
u-boot-odroid-c2-doc
u-boot-odroid-c4
u-boot-odroid-c4-doc
u-boot-odroid-n2
u-boot-odroid-n2-doc
u-boot-orangepipc2
u-boot-nanopia64
u-boot-p2371-2180
u-boot-p2371-2180-doc
u-boot-p2771-0000-500
u-boot-p2771-0000-500-doc
u-boot-p3450-0000
u-boot-p3450-0000-doc
u-boot-pine64plus
u-boot-pinebook
u-boot-mvebumcbin-88f8040
u-boot-mvebuespressobin-88f3720-doc
u-boot-mvebuespressobin-88f3720
u-boot-mvebudbarmada8k-doc
u-boot-mvebudbarmada8k
u-boot-mvebudb-88f3720-doc
u-boot-mvebudb-88f3720
u-boot-mvebumcbin-88f8040-doc
uboot-images-elf
uboot-tools-debugsource
uboot-tools-debuginfo
uboot-tools
uboot-tools-help
uboot-images-armv8
u-boot-rock-pi-n10-rk3399pro-doc
u-boot-rock-pi-n10-rk3399pro
u-boot-microchip (Ubuntu package)
u-boot-stm32 (Ubuntu package)

Install updates from vendor's website.

Universal Boot Loader (U-Boot) - update to 2022.07
u-boot-tools (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-qcom (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-qemu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sunxi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-tegra (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-omap (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-imx (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-mvebu (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-amlogic (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rockchip (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rpi (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-exynos (Ubuntu package) - addressed in versions 2020.10+dfsg-1ubuntu0~18.04.3, 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-sifive (Ubuntu package) - addressed in versions 2021.01+dfsg-3ubuntu0~20.04.5, 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-rock960-rk3399-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pinebook-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rock960-rk3399 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rock64-rk3328-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rock64-rk3328 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rock-pi-4-rk3399-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rock-pi-4-rk3399 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-poplar-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-poplar - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pinephone-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pineh64-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pineh64 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pinebook-pro-rk3399-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pinebook-pro-rk3399 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rockpro64-rk3399 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rockpro64-rk3399-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rpi3 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rpi3-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rpi4 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rpi4-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rpiarm64 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-rpiarm64-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-xilinxzynqmpvirt - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-xilinxzynqmpvirt-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-xilinxzynqmpzcu102rev10 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-xilinxzynqmpzcu102rev10-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-tools - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pinephone - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-geekbox - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-ls1012afrdmqspi-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-ls1012afrdmqspi - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-libretech-cc-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-libretech-cc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-libretech-ac-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-libretech-ac - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-khadas-vim2-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-khadas-vim2 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-khadas-vim-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-khadas-vim - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-hikey-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-hikey - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-geekbox-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pine64plus-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-firefly-rk3399-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-firefly-rk3399 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-evb-rk3399-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-evb-rk3399 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-dragonboard820c-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-dragonboard820c - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-dragonboard410c-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-dragonboard410c - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-bananapim64-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-bananapim64 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-avnetultra96rev1-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-avnetultra96rev1 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-tools-debuginfo - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-orangepipc2-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-nanopia64-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-odroid-c2 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-odroid-c2-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-odroid-c4 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-odroid-c4-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-odroid-n2 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-odroid-n2-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-orangepipc2 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-nanopia64 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-p2371-2180 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-p2371-2180-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-p2771-0000-500 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-p2771-0000-500-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-p3450-0000 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-p3450-0000-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pine64plus - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-pinebook - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-mvebumcbin-88f8040 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-mvebuespressobin-88f3720-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-mvebuespressobin-88f3720 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-mvebudbarmada8k-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-mvebudbarmada8k - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-mvebudb-88f3720-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-mvebudb-88f3720 - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
u-boot-mvebumcbin-88f8040-doc - addressed in versions 2021.01-150300.7.18.1, 2021.10-150400.4.11.1
uboot-images-elf - update to 2021.10-10
uboot-tools-debugsource - update to 2021.10-10
uboot-tools-debuginfo - update to 2021.10-10
uboot-tools - update to 2021.10-10
uboot-tools-help - update to 2021.10-10
uboot-images-armv8 - update to 2021.10-10
u-boot-rock-pi-n10-rk3399pro-doc - update to 2021.10-150400.4.11.1
u-boot-rock-pi-n10-rk3399pro - update to 2021.10-150400.4.11.1
u-boot-microchip (Ubuntu package) - addressed in versions 2022.01+dfsg-2ubuntu2.3, 2022.07+dfsg-1ubuntu4.2
u-boot-stm32 (Ubuntu package) - update to 2022.07+dfsg-1ubuntu4.2

• https://lore.kernel.org/all/20220609140206.297405-1-miquel.raynal@bootlin.com/
• https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com/

• Privilege escalation in U-Boot
• SUSE update for u-boot
• SUSE update for u-boot
• Ubuntu update for u-boot
• openEuler 22.03 LTS SP3 update for uboot-tools
• openEuler 22.03 LTS SP4 update for uboot-tools