nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade u-boot | Mar 21, 2024 | May 16, 2022 |
| Debian | — | Upgrade u-boot | Jul 30, 2024 | May 16, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade uboot-tools-help | Dec 22, 2022 | May 16, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade uboot-tools-help | Nov 15, 2022 | May 16, 2022 |
| Suse | — | Upgrade u-boot-libretech-cc-docUpgrade u-boot-dragonboard410c-docUpgrade u-boot-rpi3-docUpgrade u-boot-nanopia64-docUpgrade u-boot-pine64plus-docUpgrade u-boot-orangepipc2Upgrade u-boot-khadas-vimUpgrade u-boot-p2371-2180-docUpgrade u-boot-avnetultra96rev1-docUpgrade u-boot-pinephone-docUpgrade u-boot-rockpro64-rk3399Upgrade u-boot-odroid-c2Upgrade u-boot-bananapim64-docUpgrade u-boot-odroid-c4Upgrade u-boot-geekboxUpgrade u-boot-avnetultra96rev1Upgrade u-boot-firefly-rk3399Upgrade u-boot-pinephoneUpgrade u-boot-rock64-rk3328Upgrade u-boot-dragonboard820c-docUpgrade u-boot-khadas-vim2-docUpgrade u-boot-rpi4Upgrade u-boot-rpiarm64Upgrade u-boot-rpiarm64-docUpgrade u-boot-hikeyUpgrade u-boot-geekbox-docUpgrade u-boot-mvebuespressobin-88f3720-docUpgrade u-boot-mvebudb-88f3720Upgrade u-boot-mvebudbarmada8k-docUpgrade u-boot-mvebuespressobin-88f3720Upgrade u-boot-mvebudbarmada8kUpgrade u-boot-rock960-rk3399Upgrade u-boot-rpi4-docUpgrade u-boot-pine64plusUpgrade u-boot-evb-rk3399-docUpgrade u-boot-ls1012afrdmqspi-docUpgrade u-boot-rockpro64-rk3399-docUpgrade u-boot-mvebumcbin-88f8040Upgrade u-boot-odroid-n2-docUpgrade u-boot-pinebook-pro-rk3399-docUpgrade u-boot-rock-pi-n10-rk3399proUpgrade u-boot-toolsUpgrade u-boot-rock-pi-4-rk3399Upgrade u-boot-libretech-ccUpgrade u-boot-rock64-rk3328-docUpgrade u-boot-dragonboard410cUpgrade u-boot-pineh64Upgrade u-boot-rock-pi-4-rk3399-docUpgrade u-boot-odroid-c2-docUpgrade u-boot-p3450-0000-docUpgrade u-boot-p2771-0000-500-docUpgrade u-boot-rock-pi-n10-rk3399pro-docUpgrade u-boot-pineh64-docUpgrade u-boot-khadas-vim-docUpgrade u-boot-firefly-rk3399-docUpgrade u-boot-pinebook-docUpgrade u-boot-poplarUpgrade u-boot-evb-rk3399Upgrade u-boot-dragonboard820cUpgrade u-boot-bananapim64Upgrade u-boot-ls1012afrdmqspiUpgrade u-boot-p2371-2180Upgrade u-boot-orangepipc2-docUpgrade u-boot-mvebumcbin-88f8040-docUpgrade u-boot-libretech-ac-docUpgrade u-boot-xilinxzynqmpzcu102rev10Upgrade u-boot-xilinxzynqmpvirt-docUpgrade u-boot-xilinxzynqmpvirtUpgrade u-boot-odroid-c4-docUpgrade u-boot-pinebookUpgrade u-boot-p2771-0000-500Upgrade u-boot-khadas-vim2Upgrade u-boot-rock960-rk3399-docUpgrade u-boot-pinebook-pro-rk3399Upgrade u-boot-odroid-n2Upgrade u-boot-p3450-0000Upgrade u-boot-libretech-acUpgrade u-boot-rpi3Upgrade u-boot-poplar-docUpgrade u-boot-nanopia64Upgrade u-boot-mvebudb-88f3720-docUpgrade u-boot-hikey-docUpgrade u-boot-xilinxzynqmpzcu102rev10-doc | Oct 26, 2022 | May 16, 2022 |
| Ubuntu | — | Upgrade u-boot-imxUpgrade u-boot-microchipUpgrade u-boot-sunxiUpgrade u-boot-rpiUpgrade u-boot-qemuUpgrade u-boot-mvebuUpgrade u-boot-exynosUpgrade u-boot-amlogicUpgrade u-boot-sifiveUpgrade u-boot-tegraUpgrade u-boot-stm32Upgrade u-bootUpgrade u-boot-rockchipUpgrade u-boot-omapUpgrade u-boot-qcomUpgrade u-boot-tools | Dec 7, 2022 | May 16, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub