Description
nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | u-boot | 2022.07+dfsg-1 | — |
| Debian 13 | u-boot | 2022.07+dfsg-1 | — |
| Debian 12 | u-boot | 2022.07+dfsg-1 | — |
| Debian 11 | u-boot | 2021.01+dfsg-5+deb11u1 | DLA-4150-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | u-boot | 2022.01+dfsg-2ubuntu2.3 | USN-5764-1 |
| Ubuntu 20.04 LTS | u-boot | 2021.01+dfsg-3ubuntu0~20.04.5 | USN-5764-1 |
| Ubuntu 18.04 LTS | u-boot | 2020.10+dfsg-1ubuntu0~18.04.3 | USN-5764-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | u-boot | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | u-boot +1 | 2021.10-150400.4.5.1 | SUSE-SU-2022:2054-1 |
| SLES 15 SP3 | u-boot +1 | 2021.01-150300.7.12.1 | SUSE-SU-2022:2053-1 |
| SLES 12 SP5 | u-boot +1 | 2019.01-5.8.1 | SUSE-SU-2022:2052-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | u-boot +1 | 2019.01-5.8.1 | SUSE-SU-2022:2052-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | u-boot +41 | 2021.10-150400.4.5.1 | SUSE-SU-2022:2054-1 |
| openSUSE Leap 15.3 | u-boot +40 | 2021.01-150300.7.12.1 | SUSE-SU-2022:2053-1 |
Advisories 7
- USN-5764-1 u-boot vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-4150-1 u-boot - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:2053-1 Security update for u-boot SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2052-1 Security update for u-boot SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2054-1 Security update for u-boot SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-23-194-04 Siemens SIMATIC MV500 Devices CISA ICS & IT advisories · May 6, 2025
- SSA-561322 SSA-561322: Multiple Vulnerabilities in SIMATIC MV500 Devices before V3.3.4 Siemens ProductCERT · Jul 11, 2023
References
- https://github.com/u-boot/u-boot/commit/5d14ee4e53a81055d34ba280cb8fd90330f22a96
- https://lists.denx.de/pipermail/u-boot/2022-May/483952.html
- https://securitylab.github.com/research/uboot-rce-nfs-vulnerability/
- FEDORA-2022-61cf1c64f6 vendor-advisory
- https://source.denx.de/u-boot/u-boot/-/commit/bdbf7a05e26f3c5fd437c99e2755ffde186ddc80