diff --git a/backport-CVE-2022-33967.patch b/backport-CVE-2022-33967.patch
new file mode 100644
index 0000000000000000000000000000000000000000..ea30f9b7077bf0614170d1786407e23d6dcfcec8
--- /dev/null
+++ b/backport-CVE-2022-33967.patch
@@ -0,0 +1,52 @@
+From e40e9a32dd411f444d6e2ed73c517ee584a386ae Mon Sep 17 00:00:00 2001
+From: Miquel Raynal <miquel.raynal@bootlin.com>
+Date: Wed, 20 Jul 2022 09:18:20 +0000
+Subject: [PATCH] fs/squashfs: Use kcalloc when relevant 
+A crafted squashfs image could embed a huge number of empty metadata
+blocks in order to make the amount of malloc()'d memory overflow and be
+much smaller than expected. Because of this flaw, any random code
+positioned at the right location in the squashfs image could be memcpy'd
+from the squashfs structures into U-Boot code location while trying to
+access the rearmost blocks, before being executed.
+
+In order to prevent this vulnerability from being exploited in eg. a
+secure boot environment, let's add a check over the amount of data
+that is going to be allocated. Such a check could look like:
+
+if (!elem_size || n > SIZE_MAX / elem_size)
+	return NULL;
+
+The right way to do it would be to enhance the calloc() implementation
+but this is quite an impacting change for such a small fix. Another
+solution would be to add the check before the malloc call in the
+squashfs implementation, but this does not look right. So for now, let's
+use the kcalloc() compatibility function fro...
+---
+ fs/squashfs/sqfs.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
+index 92ab8ac6..ef4b5836 100644
+--- a/fs/squashfs/sqfs.c
++++ b/fs/squashfs/sqfs.c
+@@ -13,6 +13,7 @@
+ #include <linux/types.h>
+ #include <linux/byteorder/little_endian.h>
+ #include <linux/byteorder/generic.h>
++#include <linux/compat.h>
+ #include <memalign.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -725,7 +726,8 @@ static int sqfs_read_inode_table(unsigned char **inode_table)
+ 		goto free_itb;
+ 	}
+ 
+-	*inode_table = malloc(metablks_count * SQFS_METADATA_BLOCK_SIZE);
++	*inode_table = kcalloc(metablks_count, SQFS_METADATA_BLOCK_SIZE,
++			       GFP_KERNEL);
+ 	if (!*inode_table) {
+ 		ret = -ENOMEM;
+ 		goto free_itb;
+-- 
+2.33.0
+
diff --git a/uboot-tools.spec b/uboot-tools.spec
index 02c05c120a8881642dd5b8bd40f4be98188df0ac..b7b0b05706039f8d5a3d9975f296a48f7af986f9 100644
--- a/uboot-tools.spec
+++ b/uboot-tools.spec
@@ -1,4 +1,4 @@
-%define anolis_release 2
+%define anolis_release 3
 
 %bcond_without toolsonly
 
@@ -16,6 +16,8 @@ ExcludeArch: s390x
 Source0:  https://ftp.denx.de/pub/u-boot/u-boot-%{version}%{?candidate:-%{candidate}}.tar.bz2
 Source1:  aarch64-boards
 
+Patch0: 	backport-CVE-2022-33967.patch
+
 BuildRequires:  bc bison dtc flex gcc
 BuildRequires:  gnutls-devel libuuid-devel ncurses-devel openssl-devel
 BuildRequires:  perl-interpreter python3-devel python3-setuptools python3-libfdt
@@ -214,6 +216,9 @@ cp -p board/rockchip/evb_rk3399/README builds/docs/README.evb_rk3399
 %doc builds/docs/* doc/board/amlogic/ doc/board/rockchip/ doc/board/ti/am335x_evm.rst
 
 %changelog
+* Wed Nov 20 2024 Zhongkun He <hezhongkun@inspur.com> - 2022-04-3
+- fix CVE-2022-33967
+
 * Mon Apr 17 2023 Heng Qi <hengqi@linux.alibaba.com> - 2022.04-2
 - disable rk3328/rk3399 and refactor the spec file