CVE-2022-30552 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 21%

Affected Products (NVD)

Vendor	Product	Version
denx	u-boot	2022.01

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Siemens	RUGGEDCOM ROX MX5000	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX MX5000RE	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX1400	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX1500	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX1501	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX1510	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX1511	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX1512	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX1524	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX1536	𝑥 < V2.17.1	ADP
Siemens	RUGGEDCOM ROX RX5000	𝑥 < V2.17.1	ADP

Debian Releases

Debian Product

Codename

u-boot

bookworm	2023.01+dfsg-2+deb12u1 fixed
bullseye	no-dsa
buster	no-dsa
sid	2024.01+dfsg-5 fixed
stretch	no-dsa
trixie	2024.01+dfsg-5 fixed

Ubuntu Releases

Ubuntu Product

Codename

u-boot

bionic	Fixed 2020.10+dfsg-1ubuntu0~18.04.3 released
focal	Fixed 2021.01+dfsg-3ubuntu0~20.04.5 released
impish	ignored
jammy	Fixed 2022.01+dfsg-2ubuntu2.3 released
kinetic	not-affected
lunar	not-affected
mantic	not-affected
noble	not-affected
xenial	needs-triage

u-boot-nezha

bionic	dne
focal	dne
jammy	Fixed 2022.04+git20220405.7446a472-0ubuntu0.4 released
kinetic	ignored
lunar	Fixed 2022.10-1089-g528ae9bc6c-0ubuntu1.23.04.2 released
mantic	ignored
noble	needed
trusty	ignored
xenial	ignored

openSUSE / SLES Releases

openSUSE Product

Release

u-boot-rpi3

suse enterprise sap 12 SP5	2019.01-5.8.1 fixed
suse enterprise server 12 SP3	2016.07-12.6.1 fixed
suse enterprise server 12 SP4	2018.03-4.6.1 fixed
suse enterprise server 12 SP5	2019.01-5.8.1 fixed
suse enterprise server 15	2018.03-150000.4.11.1 fixed
suse enterprise server 15 SP1	2019.01-150100.7.13.1 fixed

u-boot-rpiarm64

suse enterprise desktop 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise desktop 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise desktop 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise desktop 15 SP6	2021.10-150600.9.2 fixed
suse enterprise desktop 15 SP7	2021.10-150600.11.3.1 fixed
suse enterprise sap 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise sap 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise sap 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise sap 15 SP6	2021.10-150600.9.2 fixed
suse enterprise sap 15 SP7	2021.10-150600.11.3.1 fixed
suse enterprise server 15 SP2	2020.01-150200.10.12.1 fixed
suse enterprise server 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise server 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise server 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise server 15 SP6	2021.10-150600.9.2 fixed
suse enterprise server 15 SP7	2021.10-150600.11.3.1 fixed

u-boot-rpiarm64-doc

suse enterprise desktop 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise desktop 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise desktop 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise desktop 15 SP6	2021.10-150600.9.2 fixed
suse enterprise desktop 15 SP7	2021.10-150600.11.3.1 fixed
suse enterprise sap 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise sap 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise sap 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise sap 15 SP6	2021.10-150600.9.2 fixed
suse enterprise sap 15 SP7	2021.10-150600.11.3.1 fixed
suse enterprise server 15 SP2	2020.01-150200.10.12.1 fixed
suse enterprise server 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise server 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise server 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise server 15 SP6	2021.10-150600.9.2 fixed
suse enterprise server 15 SP7	2021.10-150600.11.3.1 fixed

u-boot-tools

suse enterprise desktop 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise desktop 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise desktop 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise desktop 15 SP6	2021.10-150600.9.3 fixed
suse enterprise desktop 15 SP7	2021.10-150600.11.3.1 fixed
suse enterprise sap 12 SP5	2019.01-5.8.1 fixed
suse enterprise sap 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise sap 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise sap 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise sap 15 SP6	2021.10-150600.9.3 fixed
suse enterprise sap 15 SP7	2021.10-150600.11.3.1 fixed
suse enterprise server 12 SP3	2016.07-12.6.1 fixed
suse enterprise server 12 SP4	2018.03-4.6.1 fixed
suse enterprise server 12 SP5	2019.01-5.8.1 fixed
suse enterprise server 15	2018.03-150000.4.11.1 fixed
suse enterprise server 15 SP1	2019.01-150100.7.13.1 fixed
suse enterprise server 15 SP2	2020.01-150200.10.12.1 fixed
suse enterprise server 15 SP3	2021.01-150300.7.12.1 fixed
suse enterprise server 15 SP4	2021.10-150400.4.5.1 fixed
suse enterprise server 15 SP5	2021.10-150400.4.5.1 fixed
suse enterprise server 15 SP6	2021.10-150600.9.3 fixed
suse enterprise server 15 SP7	2021.10-150600.11.3.1 fixed

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

https://github.com/u-boot/u-boot/tags

https://research.nccgroup.com/2022/06/03/technical-advisory-multiple-vulnerabilities-in-u-boot-cve-2022-30790-cve-2022-30552/

https://github.com/u-boot/u-boot/tags

https://lists.debian.org/debian-lts-announce/2025/05/msg00001.html

https://research.nccgroup.com/2022/06/03/technical-advisory-multiple-vulnerabilities-in-u-boot-cve-2022-30790-cve-2022-30552/

https://cert-portal.siemens.com/productcert/html/ssa-577017.html