CVE-2022-49320

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

In zynqmp_dma_alloc/free_chan_resources functions there is a potential overflow in the below expressions.

dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL);

The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though this overflow condition is not observed but it is a potential problem in the case of 32-bit multiplication. Hence fix it by changing the desc_size data type to size_t.

In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in dma_alloc_coherent API argument.

Leer descripción completaMostrar menos

Addresses-Coverity: Event overflow_before_widen.

Detalles técnicos trazas, registros y código del informe original

dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *
                 ZYNQMP_DMA_NUM_DESCS),
                chan->desc_pool_v, chan->desc_pool_p);

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 5.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.27%
Percentil entre todas las CVEs puntuadas: 18
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

CWE-190

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-49320",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b0cc417c1637192be658e68a74c8d1568e3d35f6",
              "lessThan": "83960276ffc9bf5570d4106490346b61e61be5f3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b0cc417c1637192be658e68a74c8d1568e3d35f6",
              "lessThan": "95a0ba85c1b51b36e909841c02d205cd223ab753",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b0cc417c1637192be658e68a74c8d1568e3d35f6",
              "lessThan": "7b5488f4721fed6e121e661e165bab06ae2f8675",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b0cc417c1637192be658e68a74c8d1568e3d35f6",
              "lessThan": "4838969e4d95d2bd2995d1605b20d3144fcb3e74",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b0cc417c1637192be658e68a74c8d1568e3d35f6",
              "lessThan": "90aefae2e3a770a6909d339f5d8a988c0b0ceaf0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b0cc417c1637192be658e68a74c8d1568e3d35f6",
              "lessThan": "f9a9f43a62a04ec3183fb0da9226c7706eed0115",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/dma/xilinx/zynqmp_dma.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.122",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.47",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.17.15",
              "versionType": "semver",
              "lessThanOrEqual": "5.17.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.4",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/dma/xilinx/zynqmp_dma.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:08.840",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4838969e4d95d2bd2995d1605b20d3144fcb3e74",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7b5488f4721fed6e121e661e165bab06ae2f8675",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/83960276ffc9bf5570d4106490346b61e61be5f3",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/90aefae2e3a770a6909d339f5d8a988c0b0ceaf0",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/95a0ba85c1b51b36e909841c02d205cd223ab753",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f9a9f43a62a04ec3183fb0da9226c7706eed0115",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type\n\nIn zynqmp_dma_alloc/free_chan_resources functions there is a\npotential overflow in the below expressions.\n\ndma_alloc_coherent(chan->dev, (2 * chan->desc_size *\n\t\t   ZYNQMP_DMA_NUM_DESCS),\n\t\t   &chan->desc_pool_p, GFP_KERNEL);\n\ndma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *\n                 ZYNQMP_DMA_NUM_DESCS),\n                chan->desc_pool_v, chan->desc_pool_p);\n\nThe arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though\nthis overflow condition is not observed but it is a potential problem\nin the case of 32-bit multiplication. Hence fix it by changing the\ndesc_size data type to size_t.\n\nIn addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in\ndma_alloc_coherent API argument.\n\nAddresses-Coverity: Event overflow_before_widen."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dmaengine: zynqmp_dma: En el tipo de datos fix desc_size de struct zynqmp_dma_chan En las funciones zynqmp_dma_alloc/free_chan_resources hay un desbordamiento potencial en las siguientes expresiones. dma_alloc_coherent(chan-&gt;dev, (2 * chan-&gt;desc_size * ZYNQMP_DMA_NUM_DESCS), &amp;chan-&gt;desc_pool_p, GFP_KERNEL); dma_free_coherent(chan-&gt;dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan-&gt;desc_pool_v, chan-&gt;desc_pool_p); Los argumentos desc_size y ZYNQMP_DMA_NUM_DESCS eran de 32 bits. Aunque esta condición de desbordamiento no se observa, es un problema potencial en el caso de la multiplicación de 32 bits. Por lo tanto, corríjala cambiando el tipo de datos desc_size a size_t. Además de corregir la cobertura, también reutilice la macro ZYNQMP_DMA_DESC_SIZE en el argumento de API dma_alloc_coherent. Direcciones: cobertura: evento overflow_before_widen."
    }
  ],
  "lastModified": "2026-06-17T05:17:42.453",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E45AC5F-6613-4B82-A23E-18D6B4EA5C82",
              "versionEndExcluding": "5.4.198",
              "versionStartIncluding": "4.8"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B42AA01-44D8-4572-95E6-FF8E374CF9C5",
              "versionEndExcluding": "5.10.122",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC042EE3-4864-4325-BE0B-4BCDBF11AA61",
              "versionEndExcluding": "5.15.47",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53E7AA2E-2FB4-45CA-A22B-08B4EDBB51AD",
              "versionEndExcluding": "5.17.15",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA6D643C-6D6A-4821-8A8D-B5776B8F0103",
              "versionEndExcluding": "5.18.4",
              "versionStartIncluding": "5.18"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}