CVE-2022-49592

HIGH EPSS 17.3%
Published Feb 26, 20251y ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Feb 26, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma queue left shift overflow issue When queue number is > 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1. If CONFIG_UBSAN is enabled, kernel dumps below warning: [ 10.363842] ================================================================== [ 10.363882] UBSAN: shift-out-of-bounds in /build/linux-intel-iotg-5.15-8e6Tf4/ linux-intel-iotg-5.15-5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c:224:12 [ 10.363929] shift exponent 40 is too large for 32-bit type 'unsigned int' [ 10.363953] CPU: 1 PID: 599 Comm: NetworkManager Not tainted 5.15.0-1003-intel-iotg [ 10.363956] Hardware name: ADLINK Technology Inc. LEC-EL/LEC-EL, BIOS 0.15.11 12/22/2021 [ 10.363958] Call Trace: [ 10.363960] <TASK> [ 10.363963] dump_stack_lvl+0x4a/0x5f [ 10.363971] dump_stack+0x10/0x12 [ 10.363974] ubsan_epilogue+0x9/0x45 [ 10.363976] __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e [ 10.363979] ? wake_up_klogd+0x4a/0x50 [ 10.363983] ? vprintk_emit+0x8f/0x240 [ 10.363986] dwmac4_map_mtl_dma.cold+0x42/0x91 [stmmac] [ 10.364001] stmmac_mtl_configuration+0x1ce/0x7a0 [stmmac] [ 10.364009] ? dwmac410_dma_init_channel+0x70/0x70 [stmmac] [ 10.364020] stmmac_hw_setup.cold+0xf/0xb14 [stmmac] [ 10.364030] ? page_pool_alloc_pages+0x4d/0x70 [ 10.364034] ? stmmac_clear_tx_descriptors+0x6e/0xe0 [stmmac] [ 10.364042] stmmac_open+0x39e/0x920 [stmmac] [ 10.364050] __dev_open+0xf0/0x1a0 [ 10.364054] __dev_change_flags+0x188/0x1f0 [ 10.364057] dev_change_flags+0x26/0x60 [ 10.364059] do_setlink+0x908/0xc40 [ 10.364062] ? do_setlink+0xb10/0xc40 [ 10.364064] ? __nla_validate_parse+0x4c/0x1a0 [ 10.364068] __rtnl_newlink+0x597/0xa10 [ 10.364072] ? __nla_reserve+0x41/0x50 [ 10.364074] ? __kmalloc_node_track_caller+0x1d0/0x4d0 [ 10.364079] ? pskb_expand_head+0x75/0x310 [ 10.364082] ? nla_reserve_64bit+0x21/0x40 [ 10.364086] ? skb_free_head+0x65/0x80 [ 10.364089] ? security_sock_rcv_skb+0x2c/0x50 [ 10.364094] ? __cond_resched+0x19/0x30 [ 10.364097] ? kmem_cache_alloc_trace+0x15a/0x420 [ 10.364100] rtnl_newlink+0x49/0x70 This change fixes MTL_RXQ_DMA_MAP1 mask issue and channel/queue mapping warning. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216195

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
17.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 13

VendorProductVersionRange
linuxlinux_kernel*≥4.12  –  <4.14.290
linuxlinux_kernel*≥4.15  –  <4.19.254
linuxlinux_kernel*≥4.20  –  <5.4.208
linuxlinux_kernel*≥5.5  –  <5.10.134
linuxlinux_kernel*≥5.11  –  <5.15.58
linuxlinux_kernel*≥5.16  –  <5.18.15
linuxlinux_kernel5.19any
linuxlinux_kernel5.19any
linuxlinux_kernel5.19any
linuxlinux_kernel5.19any
linuxlinux_kernel5.19any
linuxlinux_kernel5.19any
linuxlinux_kernel5.19any

References 7

  • git.kernel.org https://git.kernel.org/stable/c/508d86ead36cbd8dfb60773a33276790d668c473
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/573768dede0e2b7de38ecbc11cb3ee47643902dc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/613b065ca32e90209024ec4a6bb5ca887ee70980
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7c687a893f5cae5ca40d189635602e93af9bab73
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a3ac79f38d354b10925824899cdbd2caadce55ba
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ad2febdfbd01e1d092a08bfdba92ede79ea05ff3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e846bde09677fa3b203057846620b7ed96540f5f
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/508d86ead36cbd8dfb60773a33276790d668c473
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/573768dede0e2b7de38ecbc11cb3ee47643902dc
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/613b065ca32e90209024ec4a6bb5ca887ee70980
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7c687a893f5cae5ca40d189635602e93af9bab73
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a3ac79f38d354b10925824899cdbd2caadce55ba
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ad2febdfbd01e1d092a08bfdba92ede79ea05ff3
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/e846bde09677fa3b203057846620b7ed96540f5f
    Patch