Vulnerability in dmaengine: zynqmp_dma
Summary
GSD-2022-1002565: dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type. Affects Kernel versions < 90aefae2e3a770a6909d339f5d8a988c0b0ceaf0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The dmaengine package is a component of the Linux Kernel that provides a framework for managing DMA (Direct Memory Access) operations. DMA allows devices to transfer data directly to and from memory without involving the CPU. The zynqmp_dma module is a specific implementation of the dmaengine framework for the Xilinx ZynqMP platform. It enables efficient data transfers between peripherals and memory on ZynqMP-based systems. However, a vulnerability has been identified in the zynqmp_dma module that affects the integrity and security of data transfers.
Vulnerability Detail
The vulnerability in the zynqmp_dma module is related to an incorrect data type used for the 'desc_size' field in the 'struct zynqmp_dma_chan' structure. The 'desc_size' field is used to specify the size of the DMA descriptors, which are data structures that describe the DMA transfer operations. By using an incorrect data type, it is possible for an attacker to manipulate the 'desc_size' value and cause a buffer overflow or other memory corruption issues. This could lead to arbitrary code execution, privilege escalation, or denial of service attacks. The vulnerability has been fixed in Linux Kernel version v5.18.4 by commit 90aefae2e3a770a6909d339f5d8a988c0b0ceaf0.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the zynqmp_dma module can have serious security implications, including arbitrary code execution and privilege escalation. It is crucial to update the Linux Kernel to version v5.18.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
dmaengine is a component of the Linux Kernel that provides a framework for managing DMA operations. It allows devices to transfer data directly to and from memory without involving the CPU, improving performance and efficiency.
The zynqmp_dma module is a specific implementation of the dmaengine framework for the Xilinx ZynqMP platform. It enables efficient data transfers between peripherals and memory on ZynqMP-based systems.
A DMA descriptor is a data structure that describes a DMA transfer operation. It includes information such as the source and destination addresses, transfer size, and control flags.
A buffer overflow is a type of software vulnerability where a program writes data beyond the boundaries of a buffer in memory. This can lead to memory corruption, crashes, and potentially allow an attacker to execute arbitrary code.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
