CVSS 5.5 · Medium EPSS 0,27%
Kerentanan Integer Overflow or Wraparound pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type In zynqmp_dma_alloc/free_chan_resources functions there is a potential overflow in the below expressions. dma_alloc_coherent(chan->dev, (2 * chan->desc_size * ZYNQMP_DMA_NUM_DESCS), &chan->desc_pool_p, GFP_KERNEL); dma_free_coherent(chan->dev,(2 * ZYNQMP_DMA_DESC_SIZE(chan) * ZYNQMP_DMA_NUM_DESCS), chan->desc_pool_v, chan->desc_pool_p); The arguments desc_size and ZYNQMP_DMA_NUM_DESCS were 32 bit. Though this overflow condition is not observed but it is a potential problem in the case of 32-bit multiplication. Hence fix it by changing the desc_size data type to size_t. In addition to coverity fix it also reuse ZYNQMP_DMA_DESC_SIZE macro in dma_alloc_coherent API argument. Addresses-Coverity: Event overflow_before_widen.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 4.8 hingga sebelum 5.4.198 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.122 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.47 |
| linux | linux kernel | Versi 5.16 hingga sebelum 5.17.15 |
| linux | linux kernel | Versi 5.18 hingga sebelum 5.18.4 |