CVE-2022-49320

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type

In zynqmp_dma_alloc/free_chan_resources functions there is a

potential overflow in the below expressions.

dma_alloc_coherent(chan->dev, (2 * chan->desc_size *

ZYNQMP_DMA_NUM_DESCS),

&chan->desc_pool_p, GFP_KERNEL);

dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) *

ZYNQMP_DMA_NUM_DESCS),

chan->desc_pool_v, chan->desc_pool_p);

The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though

this overflow condition is not observed but it is a potential problem

in the case of 32-bit multiplication. Hence fix it by changing the

desc_size data type to size_t.

In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in

dma_alloc_coherent API argument.

Addresses-Coverity: Event overflow_before_widen.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References