CVE-2022-30767

Name of the Vulnerable Software and Affected Versions U-Boot versions through 2022.04 U-Boot versions through 2022.07-rc2

Description The issue is related to the nfs lookup reply function in net/nfs.c, which is part of the U-Boot bootloader for Linux-based embedded operating systems. It involves a buffer copy operation without proper input size validation, potentially leading to a buffer overflow. This could allow an attacker to execute arbitrary code.

Recommendations For U-Boot versions through 2022.04, update to a version that includes a correct fix for the issue. For U-Boot versions through 2022.07-rc2, update to a version that includes a correct fix for the issue. As a temporary workaround, consider restricting access to the nfs lookup reply function in net/nfs.c to minimize the risk of exploitation.