VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 1, 2022· Updated Nov 3, 2025

CVE-2022-33103

CVE-2022-33103

Description

Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an out-of-bounds write via the function sqfs_readdir().

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Das U-Boot versions v2020.10 to v2022.07-rc3 have an out-of-bounds write in sqfs_readdir(), leading to potential memory corruption.

Vulnerability

Das U-Boot from v2020.10 to v2022.07-rc3 contains an out-of-bounds write vulnerability in the sqfs_readdir() function of the SquashFS filesystem support [1][2]. The bug occurs when processing a specially crafted SquashFS filesystem image that provides malformed directory entries, causing the code to write beyond the allocated buffer [2]. Affected versions are all releases from v2020.10 up to and including v2022.07-rc3 [1][2].

Exploitation

An attacker with the ability to supply a malicious SquashFS image (e.g., by providing a crafted root filesystem that U-Boot will read during boot, or by convincing a user to load such an image) can trigger the out-of-bounds write. No authentication is required beyond the ability to have U-Boot process the malicious filesystem; the attacker does not need network access if physical or local loading is possible [1][2].

Impact

Successful exploitation results in memory corruption, which may cause a denial of service or potentially lead to arbitrary code execution within the U-Boot environment. The exact privilege level is that of U-Boot itself, which operates before the operating system boots [1][2].

Mitigation

A fix was introduced in U-Boot commit 4136ab00b2b2 ("squashfs: fix out-of-bounds write in sqfs_readdir") and is included in U-Boot v2022.07 and later releases [1][2]. Users should upgrade to v2022.07 or apply the patch to earlier versions. No workaround has been published for systems that cannot immediately update.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!

AI Insight generated on May 25, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

89

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.