CVE-2022-30767

CRITICAL 9.8CVE-2022-30767 · Published 16/05/2022 · updated 17/06/2026

In short

CVE-2022-30767 is a CRITICAL (CVSS 9.8) vulnerability affecting u-boot (denx).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 86.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
u-boot denx	`= 2022.07≤ 2022.04`	No fix yet

Description

nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.

References

u-boot/u-boot commit 5d14ee4 · Patch
lists.denx.de/pipermail/u-boot/2022-May/483952.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB
securitylab.github.com/research/uboot-rce-nfs-vulnerability · Exploit
source.denx.de/u-boot/u-boot/-/commit/bdbf7a05e26f3c5fd437c99e2755ffde186ddc80 · Patch
lists.debian.org/debian-lts-announce/2025/05/msg00001.html

More vulnerabilities in u-boot

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

u-boot

denx

= 2022.07≤ 2022.04

No fix yet

More vulnerabilities in u-boot

See all →