Executive brief
The Linux kernel's FPGA device framework contains an integer overflow vulnerability in interrupt handling code. An attacker with local access to FPGA devices could trigger memory corruption, potentially leading to privilege escalation or system crash. This affects systems using 32-bit architectures running vulnerable kernel versions.
Technical details
The vulnerability is an integer overflow in the dfl_feature_ioctl_set_irq() function within the FPGA device framework. The vulnerable code performs a multiplication "hdr.count * sizeof(s32)" without overflow protection, which can wrap on 32-bit systems when hdr.count is sufficiently large. This causes memdup_user() to allocate a smaller buffer than expected, leading to heap-based memory corruption. An attacker with local access to FPGA device files can exploit this by calling the ioctl with a malicious count value. The fix replaces the unsafe multiplication with the kernel's array_size() macro, which safely detects and prevents overflow conditions.
Affected products
- Linux Linux kernel Versions prior to upstream commit 939bc5453b8cbdde9f1e5110ce8309aedb1b501a (September 2022), affecting stable branches and distributions shipping vulnerable kernel versions
Timeline
- 2022-09-01: disclosed
- 2022-09-04: patched
- 2025-12-08: other: Advisory published to NVD