Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-33967

squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jpcert

Description

squashfs filesystem implementation of U-Boot versions from v2020.10-rc2 to v2022.07-rc5 contains a heap-based buffer overflow vulnerability due to a defect in the metadata reading process. Loading a specially crafted squashfs image may lead to a denial-of-service (DoS) condition or arbitrary code execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

DENX Software Engineering U-Boot

  • versions from v2020.10-rc2 to v2022.07-rc5affected

References