CVE-2022-49320

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49320

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type In zynqmp_dma_alloc/free_chan_resources functions there is a potential overflow in the below expressions. dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL); dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p); The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though this overflow condition is not observed but it is a potential problem in the case of 32-bit multiplication. Hence fix it by changing the desc_size data type to size_t. In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in dma_alloc_coherent API argument. Addresses-Coverity: Event overflow_before_widen.

References
Link Resource
https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74 Patch
https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675 Patch
https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3 Patch
https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0 Patch
https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753 Patch
https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

22 Sep 2025, 20:46

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: zynqmp_dma: En el tipo de datos fix desc_size de struct zynqmp_dma_chan En las funciones zynqmp_dma_alloc/free_chan_resources hay un desbordamiento potencial en las siguientes expresiones. dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL); dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p); Los argumentos desc_size y ZYNQMP_DMA_NUM_DESCS eran de 32 bits. Aunque esta condición de desbordamiento no se observa, es un problema potencial en el caso de la multiplicación de 32 bits. Por lo tanto, corríjala cambiando el tipo de datos desc_size a size_t. Además de corregir la cobertura, también reutilice la macro ZYNQMP_DMA_DESC_SIZE en el argumento de API dma_alloc_coherent. Direcciones: cobertura: evento overflow_before_widen.
References () https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74 - () https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74 - Patch
References () https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675 - () https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675 - Patch
References () https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3 - () https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3 - Patch
References () https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0 - () https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0 - Patch
References () https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753 - () https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753 - Patch
References () https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115 - () https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-190

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-09-22 20:46

NVD link : CVE-2022-49320

Mitre link : CVE-2022-49320

CVE.ORG link : CVE-2022-49320

JSON object : View

Products Affected

linux

CWE
CWE-190

Integer Overflow or Wraparound