CVE-2022-49320 dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
An integer overflow in the ZynqMP DMA driver could lead to memory allocation issues, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49320?
CVE-2022-49320 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
In zynqmp_dma_alloc/free_chan_resources functions there is a potential overflow in the below expressions.
dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL);
dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p);
The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though this overflow condition is not observed but it is a potential problem in the case of 32-bit multiplication. Hence fix it by changing the desc_size data type to size_t.
In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in dma_alloc_coherent API argument.
Addresses-Coverity: Event overflow_before_widen.
Weakness: CWE-190
Which versions are affected by CVE-2022-49320?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49320?
Apply the vendor's patch.
Is CVE-2022-49320 being exploited?
There is no known exploitation of CVE-2022-49320 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49320, GHSA-j46v-cqvq-vwmc, UBUNTU-CVE-2022-49320.