Debian dla-4150 : u-boot - security update

critical Nessus Plugin ID 235044

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4150 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4150-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert May 01, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : u-boot Version : 2021.01+dfsg-5+deb11u1 CVE ID : CVE-2019-14196 CVE-2022-2347 CVE-2022-30552 CVE-2022-30767 CVE-2022-30790 CVE-2022-33103 CVE-2022-33967 CVE-2022-34835 CVE-2024-57254 CVE-2024-57255 CVE-2024-57256 CVE-2024-57257 CVE-2024-57258 CVE-2024-57259 Debian Bug : 1014470 1014471 1014528 1014529 1014959 1098254

Multiple vulnerabilties were discovered in u-boot, a boot loader for embedded systems.

CVE-2022-2347

An unchecked length field leading to a heap overflow.

CVE-2022-30552 and CVE-2022-30790

Buffer Overflow.

CVE-2022-30767 (CVE-2019-14196)

Unbounded memcpy with a failed length check, leading to a buffer overflow. This issue exists due to an incorrect fix for CVE-2019- 14196.

CVE-2022-33103

Out-of-bounds write.

CVE-2022-33967

Heap-based buffer overflow vulnerability which may lead to a denial- of-service (DoS).

CVE-2022-34835

Integer signedness error and resultant stack-based buffer overflow.

CVE-2024-57254

Integer overflow.

CVE-2024-57255

Integer overflow.

CVE-2024-57256

Integer overflow.

CVE-2024-57257

Stack consumption issue.

CVE-2024-57258

Multiple integer overflows.

CVE-2024-57259

Off-by-one error resulting in heap memory corruption.

For Debian 11 bullseye, these problems have been fixed in version 2021.01+dfsg-5+deb11u1.

We recommend that you upgrade your u-boot packages.

For the detailed security status of u-boot please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/u-boot

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the u-boot packages.

Plugin Details

Severity: Critical

ID: 235044

File Name: debian_DLA-4150.nasl

Version: 1.3

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 5/1/2025

Updated: 5/7/2025

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.3

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2022-34835

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:u-boot-imx, p-cpe:/a:debian:debian_linux:u-boot-qemu, p-cpe:/a:debian:debian_linux:u-boot-rockchip, p-cpe:/a:debian:debian_linux:u-boot-exynos, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:u-boot, p-cpe:/a:debian:debian_linux:u-boot-qcom, p-cpe:/a:debian:debian_linux:u-boot-omap, p-cpe:/a:debian:debian_linux:u-boot-amlogic, p-cpe:/a:debian:debian_linux:u-boot-tegra, p-cpe:/a:debian:debian_linux:u-boot-tools, p-cpe:/a:debian:debian_linux:u-boot-rpi, p-cpe:/a:debian:debian_linux:u-boot-mvebu, p-cpe:/a:debian:debian_linux:u-boot-sunxi

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/1/2025

Vulnerability Publication Date: 7/31/2019

Reference Information

CVE: CVE-2019-14196, CVE-2022-2347, CVE-2022-30552, CVE-2022-30767, CVE-2022-30790, CVE-2022-33103, CVE-2022-33967, CVE-2022-34835, CVE-2024-57254, CVE-2024-57255, CVE-2024-57256, CVE-2024-57257, CVE-2024-57258, CVE-2024-57259

Detections

Analytics