CVE-2022-49387 watchdog: rzg2l_wdt: Fix 32bit overflow issue
A 32-bit integer overflow in the RZ/G2L watchdog driver can cause timer cycles to become zero, potentially leading to a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49387?
CVE-2022-49387 is a medium-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
watchdog: rzg2l_wdt: Fix 32bit overflow issue
The value of timer_cycle_us can be 0 due to 32bit overflow. For eg:- If we assign the counter value "0xfff" for computing maxval.
This patch fixes this issue by appending ULL to 1024, so that it is promoted to 64bit.
This patch also fixes the warning message, 'watchdog: Invalid min and max timeout values, resetting to 0!'.
Weakness: CWE-190
Which versions are affected by CVE-2022-49387?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49387?
Apply the vendor's patch.
Is CVE-2022-49387 being exploited?
There is no known exploitation of CVE-2022-49387 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49387, GHSA-x3v3-vr8q-m495, UBUNTU-CVE-2022-49387.