| Name | CVE-2022-33103 |
| Description | Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir(). |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1014528 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| u-boot (PTS) | jessie | 2014.10+dfsg1-5 | fixed |
| stretch | 2016.11+dfsg1-4 | fixed |
| buster | 2019.01+dfsg-7 | fixed |
| bullseye | 2021.01+dfsg-5 | vulnerable |
| bookworm | 2023.01+dfsg-2+deb12u1 | fixed |
| sid, trixie | 2024.01+dfsg-5 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|
| u-boot | source | jessie | (not affected) | | | |
| u-boot | source | stretch | (not affected) | | | |
| u-boot | source | buster | (not affected) | | | |
| u-boot | source | (unstable) | 2022.07+dfsg-1 | | | 1014528 |
Notes
[bullseye] - u-boot <no-dsa> (Minor issue)
[buster] - u-boot <not-affected> (SquashFS support added in 2020.10)
https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com/
https://lore.kernel.org/all/20220609140206.297405-1-miquel.raynal@bootlin.com/
Fixed by: https://source.denx.de/u-boot/u-boot/-/commit/2ac0baab4aff1a0b45067d0b62f00c15f4e86856 (v2022.07-rc5)
[stretch] - u-boot <not-affected> (SquashFS support added in 2020.10)
[jessie] - u-boot <not-affected> (SquashFS support added in 2020.10)