Integer Overflow Vulnerability in Linux Kernel - gpio-xilinx Package
Summary
CVE-2022-49570: In the Linux kernel, the following vulnerability has been resolved: gpio: gpio-xilinx: Fix integer overflow Current implementation is not able to configure more than 32 pins due to incorrect data type. Affects linux versions < 5.18.16-1. Fixed in 5.18.16-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including process management, memory management, and device control. The gpio-xilinx package specifically handles GPIO (General Purpose Input/Output) operations for Xilinx devices, allowing for flexible control of hardware pins. However, this package is susceptible to an integer overflow vulnerability that limits its ability to configure more than 32 pins due to incorrect data type handling.
Vulnerability Detail
The vulnerability identified as CVE-2022-49570 arises from an integer overflow in the gpio-xilinx implementation within the Linux kernel. The current implementation uses an incorrect data type that restricts the configuration of GPIO pins to a maximum of 32. This limitation can lead to unexpected behavior or crashes when attempting to configure more pins, potentially compromising system stability and functionality. The issue has been resolved by type casting to an unsigned long to accommodate a greater number of pins.
How To Fix
Minimum fixed version
5.18.16-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the package.
Conclusion
The CVE-2022-49570 vulnerability in the Linux kernel's gpio-xilinx package poses a significant risk by limiting GPIO pin configuration due to an integer overflow. Users are advised to update to the patched version to mitigate this risk. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49570 is a vulnerability in the Linux kernel's gpio-xilinx package that results from an integer overflow, limiting the configuration of GPIO pins.
This vulnerability can lead to system instability and crashes when attempting to configure more than 32 GPIO pins, potentially affecting hardware control.
Yes, the vulnerability has been patched in version 5.18.16-1 of the Linux package for both Debian 12 and Debian 13.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Vulert is a tool that helps monitor and alert for open-source vulnerabilities in real-time. You can explore its features at https://vulert.com.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
