Heap-based Buffer Overflow in U-Boot's SquashFS Filesystem Implementation

CVE-2022-33967

What is CVE-2022-33967?

The U-Boot bootloader, specifically its implementation of the SquashFS filesystem, is affected by a heap-based buffer overflow vulnerability. This issue arises during the metadata reading process when loading specially crafted SquashFS images. Exploitation of this vulnerability can lead to a denial-of-service (DoS) condition or allow for arbitrary code execution, posing significant risks to systems utilizing affected versions of U-Boot. It is crucial for users and administrators to assess their installations and update to the latest versions to mitigate these risks.

References