USN-5764-1
- Source
- https://ubuntu.com/security/notices/USN-5764-1
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5764-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-5764-1
- Upstream
- Related
- Published
- 2022-12-06T12:54:01.363299Z
- Modified
- 2025-10-13T04:36:10Z
- Summary
- u-boot vulnerabilities
- Details
-
It was discovered that U-Boot incorrectly handled certain USB DFU download setup packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-2347)
Nicolas Bidron and Nicolas Guigo discovered that U-Boot incorrectly handled certain fragmented IP packets. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-30552, CVE-2022-30790)
It was discovered that U-Boot incorrectly handled certain NFS lookup replies. A remote attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-30767)
Jincheng Wang discovered that U-Boot incorrectly handled certain SquashFS structures. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-33103)
Tatsuhiko Yasumatsu discovered that U-Boot incorrectly handled certain SquashFS structures. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-33967)
It was discovered that U-Boot incorrectly handled the i2c command. A local attacker could use this issue to cause U-Boot to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-34835)
- References
-
- https://ubuntu.com/security/notices/USN-5764-1
- https://ubuntu.com/security/CVE-2022-2347
- https://ubuntu.com/security/CVE-2022-30552
- https://ubuntu.com/security/CVE-2022-30767
- https://ubuntu.com/security/CVE-2022-30790
- https://ubuntu.com/security/CVE-2022-33103
- https://ubuntu.com/security/CVE-2022-33967
- https://ubuntu.com/security/CVE-2022-34835
Affected packages
Ubuntu:18.04:LTS / u-boot
Package
- Name
- u-boot
- Purl
- pkg:deb/ubuntu/u-boot@2020.10+dfsg-1ubuntu0~18.04.3?arch=source&distro=bionic
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2020.10+dfsg-1ubuntu0~18.04.3
Affected versions
2016.*
2016.03+dfsg1-6ubuntu2
2018.*
2018.07~rc3+dfsg1-0ubuntu1~18.04.1
2018.07~rc3+dfsg1-0ubuntu2~18.04.1
2018.07~rc3+dfsg1-0ubuntu3~18.04.1
2019.*
2019.07+dfsg-1ubuntu4~18.04.1
2020.*
2020.10+dfsg-1ubuntu0~18.04.2
Ecosystem specific
{
"binaries": [
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-amlogic"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-exynos"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-imx"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-mvebu"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-omap"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-qcom"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-qemu"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-rockchip"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-rpi"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-sunxi"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-tegra"
},
{
"binary_version": "2020.10+dfsg-1ubuntu0~18.04.3",
"binary_name": "u-boot-tools"
}
],
"availability": "No subscription required"
}
Database specific
{
"cves_map": {
"cves": [
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-2347"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30552"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30767"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30790"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-33103"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-33967"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-34835"
}
],
"ecosystem": "Ubuntu:18.04:LTS"
}
}
Ubuntu:20.04:LTS / u-boot
Package
- Name
- u-boot
- Purl
- pkg:deb/ubuntu/u-boot@2021.01+dfsg-3ubuntu0~20.04.5?arch=source&distro=focal
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2021.01+dfsg-3ubuntu0~20.04.5
Affected versions
2019.*
2019.07+dfsg-1ubuntu3
2019.07+dfsg-1ubuntu5
2019.07+dfsg-1ubuntu6
2020.*
2020.10+dfsg-1ubuntu0~20.04.2
2021.*
2021.01+dfsg-3ubuntu0~20.04.1
2021.01+dfsg-3ubuntu0~20.04.3
2021.01+dfsg-3ubuntu0~20.04.4
Ecosystem specific
{
"binaries": [
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-amlogic"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-exynos"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-imx"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-mvebu"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-omap"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-qcom"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-qemu"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-rockchip"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-rpi"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-sifive"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-sunxi"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-tegra"
},
{
"binary_version": "2021.01+dfsg-3ubuntu0~20.04.5",
"binary_name": "u-boot-tools"
}
],
"availability": "No subscription required"
}
Database specific
{
"cves_map": {
"cves": [
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-2347"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30552"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30767"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30790"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-33103"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-33967"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-34835"
}
],
"ecosystem": "Ubuntu:20.04:LTS"
}
}
Ubuntu:22.04:LTS / u-boot
Package
- Name
- u-boot
- Purl
- pkg:deb/ubuntu/u-boot@2022.01+dfsg-2ubuntu2.3?arch=source&distro=jammy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2022.01+dfsg-2ubuntu2.3
Affected versions
2021.*
2021.07+dfsg-0ubuntu8
2021.07+dfsg-0ubuntu9
2021.07+dfsg-0ubuntu10
2022.*
2022.01+dfsg-2ubuntu1
2022.01+dfsg-2ubuntu2
2022.01+dfsg-2ubuntu2.1
Ecosystem specific
{
"binaries": [
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-amlogic"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-exynos"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-imx"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-microchip"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-mvebu"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-omap"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-qcom"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-qemu"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-rockchip"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-rpi"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-sifive"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-sunxi"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-tegra"
},
{
"binary_version": "2022.01+dfsg-2ubuntu2.3",
"binary_name": "u-boot-tools"
}
],
"availability": "No subscription required"
}
Database specific
{
"cves_map": {
"cves": [
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-2347"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30552"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30767"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-30790"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-33103"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-33967"
},
{
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"id": "CVE-2022-34835"
}
],
"ecosystem": "Ubuntu:22.04:LTS"
}
}