CVE-2022-33967

Published: Jul 20, 2022Modified: Nov 3, 2025

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.

Affected (28)

Products: Denx: U Boot

Denx

1 product

U Boot

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Denx U Boot	Version 2020.10 rc2
Denx U Boot	Version 2020.10 rc3
Denx U Boot	Version 2020.10 rc4
Denx U Boot	Version 2020.10 rc5
Denx U Boot	Version 2021.01
Denx U Boot	Version 2021.01 rc1
Denx U Boot	Version 2021.01 rc2
Denx U Boot	Version 2021.01 rc3
Denx U Boot	Version 2021.01 rc4
Denx U Boot	Version 2021.01 rc5
Denx U Boot	Version 2021.04 rc1
Denx U Boot	Version 2021.04 rc2
Denx U Boot	Version 2022.01
Denx U Boot	Version 2022.01 rc1
Denx U Boot	Version 2022.01 rc2
Denx U Boot	Version 2022.01 rc3
Denx U Boot	Version 2022.01 rc4
Denx U Boot	Version 2022.04
Denx U Boot	Version 2022.04 rc1
Denx U Boot	Version 2022.04 rc2
Denx U Boot	Version 2022.04 rc3
Denx U Boot	Version 2022.04 rc4
Denx U Boot	Version 2022.04 rc5
Denx U Boot	Version 2022.07 rc1
Denx U Boot	Version 2022.07 rc2
Denx U Boot	Version 2022.07 rc3
Denx U Boot	Version 2022.07 rc4
Denx U Boot	Version 2022.07 rc5