CVE-2022-30767 Memory corruption in n/a

Critical 9.8 Published 16 May 2022 Updated 3 Nov 2025

A buffer overflow in the U-Boot NFS client allows attackers to execute arbitrary code or cause denial of service via crafted network responses.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-30767?

CVE-2022-30767 is a critical memory corruption vulnerability in Fedoraproject Fedora, published on 16 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.

Weakness: CWE-120

Which versions are affected by CVE-2022-30767?

It affects 2 products.

Products include Denx U-Boot, Fedoraproject Fedora.

How do I fix CVE-2022-30767?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-30767 being exploited?

There is no known exploitation of CVE-2022-30767 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2022-30767, GHSA-27g3-5ffj-8mw8, OESA-2022-1978, ROOT-OS-ALPINE-316-CVE-2022-30767, UBUNTU-CVE-2022-30767.