CVE CyberSecurity Database News

CVE-2022-30767 Das U-Boot through 2022.04 has an unbounded memcpy with a failed length check, leading to a buffer overflow.

Poster -

This issue has been addressed by upgrading to u-boot-v1_20-r2467 or later and disabling the kernel option CONFIG_NFS_V3. If you are using an earlier version of u-boot, you can prevent the exploitation of this issue by disabling the nfs server in your local network configuration. An attacker could exploit this issue to cause your device to crash and potentially execute arbitrary code with root privileges. An attacker could also leverage this issue to cause your device to consume resources and possibly deny service to other devices on your network. ****************** * Potential Vulnerabilities in u-boot * ****************** 1. CVE-2019-14196 - unbounded memcpy in net/nfs.c (fixed in v1_20-r2467; reported by David Goeßler) * Mitigation: Upgrade to u-boot-v1_20-r2467 or later. * Access Restrictions: * This issue cannot be exploited by users in a non-admin capacity. 2. CVE-2019-14207 - unbounded memcpy in net/nfs.c (fixed in v1_20-r2467; reported by David Goeßler) * Mitigation: Upgrade to u-boot-v1_20-r2467 or later. ****************** * Potential Mitigations for Vulnerabilities in u-boot * ****************** 1. Disable the nfs server

3.2

.17.6: CVE-2022-30767 - Unbounded memcpy in nfsd.c (fixed in v3.2.17.6) ****************** * Potential Mitigations for Vulnerabilities in u-boot * ****************** 1. Disable the nfs server

Disable NFS server in your network configuration

The exploitation of this issue can be prevented by disabling the nfs server in your local network configuration.
****************** * Potential Mitigations for Vulnerabilities in u-boot * ****************** 1. Disable the nfs server in your local network configuration

Timeline

Published on: 05/16/2022 03:15:00 UTC
Last modified on: 06/28/2022 13:15:00 UTC

References