CVE-2022-49404 - RDMA/hfi1: Fix potential integer multiplication overflow errors

Back Back to CVE browser

MEDIUM

RDMA/hfi1: Fix potential integer multiplication overflow errors

Published Feb 26, 2025

5.5

MEDIUM

CVSS 3.1

EPSS 0.28%

Description

When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the conversion is done after the multiplication. So arithmetic overflow and thus in incorrect value is possible.

Correct an instance of this in the inter packet delay calculation. Fix by ensuring one of the operands is u64 which will promote the other to u64 as well ensuring no overflow.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  4.3
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <4.3
- Version
  4.14.283
  Status
  unaffected
  Constraints
  <=4.14.*
- Version
  4.19.247
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  4.9.318
  Status
  unaffected
  Constraints
  <=4.9.*
- Version
  5.10.121
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.46
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.17.14
  Status
  unaffected
  Constraints
  <=5.17.*
- Version
  5.18.3
  Status
  unaffected
  Constraints
  <=5.18.*
- Version
  5.19
  Status
  unaffected
  Constraints
  <=*
- Version
  5.4.198
  Status
  unaffected
  Constraints
  <=5.4.*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
4.3	affected	-
0	unaffected	<4.3
4.14.283	unaffected	<=4.14.*
4.19.247	unaffected	<=4.19.*
4.9.318	unaffected	<=4.9.*
5.10.121	unaffected	<=5.10.*
5.15.46	unaffected	<=5.15.*
5.17.14	unaffected	<=5.17.*
5.18.3	unaffected	<=5.18.*
5.19	unaffected	<=*
5.4.198	unaffected	<=5.4.*

Red Hat Enterprise Linux 8

kernel-0:4.18.0-425.3.1.el8

Fixed · RHSA-2022:7683
Red Hat Enterprise Linux 9

kernel-0:5.14.0-162.6.1.el9_1

Fixed · RHSA-2022:8267
Red Hat Enterprise Linux 9

kernel-0:5.14.0-162.6.1.el9_1

Fixed · RHSA-2022:8267
Red Hat Enterprise Linux 10

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Out of support scope
Red Hat Enterprise Linux 7

kernel-rt

Out of support scope
Red Hat Enterprise Linux 8

kernel-rt

Fix deferred
Red Hat Enterprise Linux 9

kernel-rt

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	kernel-0:4.18.0-425.3.1.el8	Fixed	RHSA-2022:7683
Red Hat Enterprise Linux 9	kernel-0:5.14.0-162.6.1.el9_1	Fixed	RHSA-2022:8267
Red Hat Enterprise Linux 9	kernel-0:5.14.0-162.6.1.el9_1	Fixed	RHSA-2022:8267
Red Hat Enterprise Linux 10	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Out of support scope	n/a
Red Hat Enterprise Linux 7	kernel-rt	Out of support scope	n/a
Red Hat Enterprise Linux 8	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel-rt	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-190

Integer Overflow

References (15)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-49404		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2348266		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-54825		Advisory
https://git.kernel.org/stable/c/06039d8afefdbac05bcea5f397188407eba2996d		Patch
https://git.kernel.org/stable/c/252f4afd4557a2e7075f793a5c80fe6dd9e9ee4a		Patch
https://git.kernel.org/stable/c/31dca00d0cc9f4133320d72eb7e3720badc6d6e6		Patch
https://git.kernel.org/stable/c/3f09ec80f115d2875d747ed28adc1773037e0f8b		Patch
https://git.kernel.org/stable/c/79c164e61f818054cd6012e9035701840d895c51		Patch
https://git.kernel.org/stable/c/8858284dd74906fa00f04f0252c75df4893a7959		Patch
https://git.kernel.org/stable/c/a89cb7ddf6a89bab6012e19da38b7cdb26175c19		Patch
https://git.kernel.org/stable/c/ef5ab2e48a5f9960e2352332b7cdb7064bb49032		Patch
https://git.kernel.org/stable/c/f93e91a0372c922c20d5bee260b0f43b4b8a1bee		Patch
https://lore.kernel.org/linux-cve-announce/2025022651-CVE-2022-49404-9bb3@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-49404
https://www.cve.org/CVERecord?id=CVE-2022-49404