diff --git a/0001-fix-cve-2022-33967.patch b/0001-fix-cve-2022-33967.patch
new file mode 100644
index 0000000000000000000000000000000000000000..a1aeb5e861e3ad3865c1099d6117824c3b74039d
--- /dev/null
+++ b/0001-fix-cve-2022-33967.patch
@@ -0,0 +1,22 @@
+diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
+index 5d9c52a..4e00333 100644
+--- a/fs/squashfs/sqfs.c
++++ b/fs/squashfs/sqfs.c
+@@ -13,6 +13,7 @@
+ #include <linux/types.h>
+ #include <linux/byteorder/little_endian.h>
+ #include <linux/byteorder/generic.h>
++#include <linux/compat.h>
+ #include <memalign.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -725,7 +726,8 @@ static int sqfs_read_inode_table(unsigned char **inode_table)
+ 		goto free_itb;
+ 	}
+ 
+-	*inode_table = malloc(metablks_count * SQFS_METADATA_BLOCK_SIZE);
++	*inode_table = kcalloc(metablks_count, SQFS_METADATA_BLOCK_SIZE,
++                             GFP_KERNEL);
+ 	if (!*inode_table) {
+ 		ret = -ENOMEM;
+ 		printf("Error: failed to allocate squashfs inode_table of size %i, increasing CONFIG_SYS_MALLOC_LEN could help\n",
diff --git a/uboot-tools.spec b/uboot-tools.spec
index 02c05c120a8881642dd5b8bd40f4be98188df0ac..a747e94edb1e0695f6eab1976a10c99b7190c9e1 100644
--- a/uboot-tools.spec
+++ b/uboot-tools.spec
@@ -1,4 +1,4 @@
-%define anolis_release 2
+%define anolis_release 3
 
 %bcond_without toolsonly
 
@@ -16,6 +16,8 @@ ExcludeArch: s390x
 Source0:  https://ftp.denx.de/pub/u-boot/u-boot-%{version}%{?candidate:-%{candidate}}.tar.bz2
 Source1:  aarch64-boards
 
+Patch0:  0001-fix-cve-2022-33967.patch
+
 BuildRequires:  bc bison dtc flex gcc
 BuildRequires:  gnutls-devel libuuid-devel ncurses-devel openssl-devel
 BuildRequires:  perl-interpreter python3-devel python3-setuptools python3-libfdt
@@ -214,6 +216,9 @@ cp -p board/rockchip/evb_rk3399/README builds/docs/README.evb_rk3399
 %doc builds/docs/* doc/board/amlogic/ doc/board/rockchip/ doc/board/ti/am335x_evm.rst
 
 %changelog
+* Thu Nov 21 2024 Xulin Gao <gaoxulin@inspur.com> - 2022.04-3
+- fix cve-2022-33967
+
 * Mon Apr 17 2023 Heng Qi <hengqi@linux.alibaba.com> - 2022.04-2
 - disable rk3328/rk3399 and refactor the spec file