CVE-2022-30790: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-30790 is a buffer overflow vulnerability affecting Das U-Boot version 2022.01. This vulnerability is distinct from CVE-2022-30552 and was discovered in early 2022. The vulnerability was officially published on June 8, 2022, and affects the U-Boot bootloader system (NVD, CVE).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) with a CVSS v3.1 base score of 7.8 (HIGH). The attack vector is local (AV:L), with low attack complexity (AC:L), requiring low privileges (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), with high impact on confidentiality (C:H), integrity (I:H), and availability (A:H) (NVD).

The vulnerability has a high severity rating with potential impacts on system confidentiality, integrity, and availability. Given the CVSS score of 7.8, successful exploitation could lead to significant system compromise, particularly concerning given U-Boot's role as a bootloader (NVD).

The vulnerability requires local access with low attack complexity and low privileges for exploitation. Technical details about the exploit have been documented by NCC Group's security research team (NCC Group).

The vulnerability has been fixed in newer versions of U-Boot. Debian has addressed this in version 2023.01+dfsg-2+deb12u1 for bookworm and 2025.01-2 for sid and trixie releases. The fix was implemented in U-Boot version v2022.07-rc4 (Debian).