32-bit Overflow Vulnerability in Linux Kernel's Watchdog Functionality
Summary
CVE-2022-49387: In the Linux kernel, the following vulnerability has been resolved: watchdog: rzg2l_wdt: Fix 32bit overflow issue The value of timer_cycle_us can be 0 due to 32bit overflow. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of functionalities, including process management, memory management, and device control. The watchdog functionality is crucial for monitoring system health and ensuring that the system remains responsive. However, vulnerabilities in this area can lead to system instability and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the watchdog functionality, specifically related to the rzg2l_wdt component. The issue arises from a 32-bit overflow in the timer_cycle_us value, which can be set to 0 due to improper calculations. This can occur when a counter value, such as '0xfff', is assigned for computing the maximum value (maxval). The overflow can lead to incorrect timeout values, potentially causing the watchdog to malfunction and resulting in system resets or failures. This vulnerability has been addressed in the patch version 5.18.5-1.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as described in the 'how_to_fix' section.
Conclusion
The CVE-2022-49387 vulnerability in the Linux kernel's watchdog functionality poses a significant risk due to a 32-bit overflow issue. It is essential to update to the patched version 5.18.5-1 to ensure system stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49387 is a vulnerability in the Linux kernel's watchdog functionality that can lead to a 32-bit overflow, causing incorrect timeout values.
This vulnerability can cause the watchdog to malfunction, potentially leading to system resets or failures, which can affect system stability and performance.
If you are using Debian 12 or 13 with a version of the Linux kernel prior to 5.18.5-1, your system may be affected by this vulnerability.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
While there are no specific workarounds, it is crucial to prioritize updating your Linux kernel to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
