CVE-2022-49235

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49235
In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0b700f7d06492de34964b6f414120043364f8191 Patch
https://git.kernel.org/stable/c/11f11ac281f0c0b363d2940204f28bae0422ed71 Patch
https://git.kernel.org/stable/c/4d244b731188e0b63fc40a9d2dec72e9181fb37c Patch
https://git.kernel.org/stable/c/5abf2b761b998063f5e2bae93fd4ab10e2a80f10 Patch
https://git.kernel.org/stable/c/5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9 Patch
https://git.kernel.org/stable/c/7da6169b6ebb75816b57be3beb829afa74f3b4b6 Patch
https://git.kernel.org/stable/c/d1e0df1c57bd30871dd1c855742a7c346dbca853 Patch
https://git.kernel.org/stable/c/e352acdd378e9263cc4c6018e588f2dac7161d07 Patch
https://git.kernel.org/stable/c/ee4222052a76559c20e821bc3519cefb58b6d3e9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

18 Mar 2025, 19:27

Type Values Removed Values Added
CWE CWE-908
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ath9k_htc: corregir errores de valores no inicializados Syzbot informó de 2 errores de KMSAN en ath9k. Todos ellos son causados por la falta de inicialización de campos. En htc_connect_service(), svc_meta_len y pad no se inicializan. Según el código, parece que en el skb actual no hay datos de servicio, por lo que simplemente inicialice svc_meta_len a 0. htc_issue_send() no inicializa la matriz htc_frame_hdr::control. Basado en el código del firmware, lo inicializará por sí mismo, así que simplemente ponga a cero toda la matriz para que KMSAN esté contento Registros de errores: ERROR: KMSAN: kernel-usb-infoleak en usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [en línea] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [en línea] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit se creó en: slab_post_alloc_hook mm/slab.h:524 [en línea] slab_alloc_node mm/slub.c:3251 [en línea] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [en línea] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [en línea] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Los bytes 4-7 de 18 no están inicializados El acceso a la memoria de tamaño 18 comienza en ffff888027377e00 ERROR: KMSAN: kernel-usb-infoleak en usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [en línea] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [en línea] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit se creó en: slab_post_alloc_hook mm/slab.h:524 [en línea] slab_alloc_node mm/slub.c:3251 [en línea] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [en línea] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [en línea] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Los bytes 16-17 de 18 no están inicializados. El acceso a la memoria de tamaño 18 comienza en ffff888027377e00
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/0b700f7d06492de34964b6f414120043364f8191 - () https://git.kernel.org/stable/c/0b700f7d06492de34964b6f414120043364f8191 - Patch
References () https://git.kernel.org/stable/c/11f11ac281f0c0b363d2940204f28bae0422ed71 - () https://git.kernel.org/stable/c/11f11ac281f0c0b363d2940204f28bae0422ed71 - Patch
References () https://git.kernel.org/stable/c/4d244b731188e0b63fc40a9d2dec72e9181fb37c - () https://git.kernel.org/stable/c/4d244b731188e0b63fc40a9d2dec72e9181fb37c - Patch
References () https://git.kernel.org/stable/c/5abf2b761b998063f5e2bae93fd4ab10e2a80f10 - () https://git.kernel.org/stable/c/5abf2b761b998063f5e2bae93fd4ab10e2a80f10 - Patch
References () https://git.kernel.org/stable/c/5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9 - () https://git.kernel.org/stable/c/5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9 - Patch
References () https://git.kernel.org/stable/c/7da6169b6ebb75816b57be3beb829afa74f3b4b6 - () https://git.kernel.org/stable/c/7da6169b6ebb75816b57be3beb829afa74f3b4b6 - Patch
References () https://git.kernel.org/stable/c/d1e0df1c57bd30871dd1c855742a7c346dbca853 - () https://git.kernel.org/stable/c/d1e0df1c57bd30871dd1c855742a7c346dbca853 - Patch
References () https://git.kernel.org/stable/c/e352acdd378e9263cc4c6018e588f2dac7161d07 - () https://git.kernel.org/stable/c/e352acdd378e9263cc4c6018e588f2dac7161d07 - Patch
References () https://git.kernel.org/stable/c/ee4222052a76559c20e821bc3519cefb58b6d3e9 - () https://git.kernel.org/stable/c/ee4222052a76559c20e821bc3519cefb58b6d3e9 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-03-18 19:27

NVD link : CVE-2022-49235

Mitre link : CVE-2022-49235

CVE.ORG link : CVE-2022-49235

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource