CVE-2022-49592: net: stmmac: fix dma queue left shift overflow issue
In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: fix dma queue left shift overflow issue
When queue number is > 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTLRXQDMAMAP1.
If CONFIGUBSAN is enabled, kernel dumps below warning: [ 10.363842] ================================================================== [ 10.363882] UBSAN: shift-out-of-bounds in /build/linux-intel-iotg-5.15-8e6Tf4/ linux-intel-iotg-5.15-5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4core.c:224:12 [ 10.363929] shift exponent 40 is too large for 32-bit type 'unsigned int' [ 10.363953] CPU: 1 PID: 599 Comm: NetworkManager Not tainted 5.15.0-1003-intel-iotg [ 10.363956] Hardware name: ADLINK Technology Inc. LEC-EL/LEC-EL, BIOS 0.15.11 12/22/2021 [ 10.363958] Call Trace: [ 10.363960] <TASK> [ 10.363963] dumpstacklvl+0x4a/0x5f [ 10.363971] dumpstack+0x10/0x12 [ 10.363974] ubsanepilogue+0x9/0x45 [ 10.363976] ubsanhandleshiftoutofbounds.cold+0x61/0x10e [ 10.363979] ? wakeupklogd+0x4a/0x50 [ 10.363983] ? vprintkemit+0x8f/0x240 [ 10.363986] dwmac4mapmtldma.cold+0x42/0x91 [stmmac] [ 10.364001] stmmacmtlconfiguration+0x1ce/0x7a0 [stmmac] [ 10.364009] ? dwmac410dmainitchannel+0x70/0x70 [stmmac] [ 10.364020] stmmachwsetup.cold+0xf/0xb14 [stmmac] [ 10.364030] ? pagepoolallocpages+0x4d/0x70 [ 10.364034] ? stmmaccleartxdescriptors+0x6e/0xe0 [stmmac] [ 10.364042] stmmacopen+0x39e/0x920 [stmmac] [ 10.364050] devopen+0xf0/0x1a0 [ 10.364054] devchangeflags+0x188/0x1f0 [ 10.364057] devchangeflags+0x26/0x60 [ 10.364059] dosetlink+0x908/0xc40 [ 10.364062] ? dosetlink+0xb10/0xc40 [ 10.364064] ? nlavalidateparse+0x4c/0x1a0 [ 10.364068] rtnlnewlink+0x597/0xa10 [ 10.364072] ? nlareserve+0x41/0x50 [ 10.364074] ? kmallocnodetrackcaller+0x1d0/0x4d0 [ 10.364079] ? pskbexpandhead+0x75/0x310 [ 10.364082] ? nlareserve64bit+0x21/0x40 [ 10.364086] ? skbfreehead+0x65/0x80 [ 10.364089] ? securitysockrcvskb+0x2c/0x50 [ 10.364094] ? condresched+0x19/0x30 [ 10.364097] ? kmemcachealloctrace+0x15a/0x420 [ 10.364100] rtnlnewlink+0x49/0x70
This change fixes MTLRXQDMAMAP1 mask issue and channel/queue mapping warning.
BugLink: https://bugzilla.kernel.org/showbug.cgi?id=216195
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49592?
CVE-2022-49592 has been classified as a moderate severity vulnerability due to its potential impact on the Linux kernel's handling of DMA queue operations.
How do I fix CVE-2022-49592?
To resolve CVE-2022-49592, ensure that you update your Linux kernel to the latest version where this vulnerability has been patched.
What versions of the Linux kernel are affected by CVE-2022-49592?
CVE-2022-49592 affects specific versions of the Linux kernel where the DMA queue left shift overflow issue exists.
What are the implications of CVE-2022-49592 if left unaddressed?
If left unaddressed, CVE-2022-49592 may lead to data corruption or unexpected behavior in systems leveraging DMA queues.
Does CVE-2022-49592 require special conditions to exploit?
Yes, CVE-2022-49592 requires that the number of DMA queues exceeds four to trigger the left shift overflow issue.