CVE-2022-2308
published 2022-09-01CVE-2022-2308: A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with…
PriorityP427medium6.5CVSS 3.1
AVLACLPRLUINSCCHINAN
EPSS
0.22%
13.3th percentile
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: use of uninitialized memory could lead to data leak in Virtio drivers with VDUSE
vendor_redhat·2022-08-19·CVSS 6.5
CVE-2022-2308 [MEDIUM] CWE-908 kernel: use of uninitialized memory could lead to data leak in Virtio drivers with VDUSE
kernel: use of uninitialized memory could lead to data leak in Virtio drivers with VDUSE
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
A flaw was found in the Linux kernel in vDPA with VDUSE backend. There were no checks in VDUSE kernel driver to ensure the size of the device config space was in line with the features advertised by the VDUSE userspace application. In case o
Debian
CVE-2022-2308: linux - A flaw was found in vDPA with VDUSE backend. There are currently no checks in VD...
vendor_debian·2022·CVSS 6.5
CVE-2022-2308 [MEDIUM] CVE-2022-2308: linux - A flaw was found in vDPA with VDUSE backend. There are currently no checks in VD...
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: resolved
forky: resolved (fixed in 6.0.2-1)
sid: resolved (fixed in 6.0.2-1)
trixie: resolved (fixed in 6.0.2-1)
GHSA
GHSA-6q37-hh76-6rv4: A flaw was found in vDPA with VDUSE backend
ghsa_unreviewed·2022-09-02
CVE-2022-2308 [HIGH] CWE-908 GHSA-6q37-hh76-6rv4: A flaw was found in vDPA with VDUSE backend
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
OSV
CVE-2022-2308: A flaw was found in vDPA with VDUSE backend
osv·2022-09-01·CVSS 6.5
CVE-2022-2308 [MEDIUM] CVE-2022-2308: A flaw was found in vDPA with VDUSE backend
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
Kernel
vduse: prevent uninitialized memory accesses
kernel_security·2022-08-31·CVSS 6.5
CVE-2022-2308 [MEDIUM] vduse: prevent uninitialized memory accesses
vduse: prevent uninitialized memory accesses
If the VDUSE application provides a smaller config space
than the driver expects, the driver may use uninitialized
memory from the stack.
This patch prevents it by initializing the buffer passed by
the driver to store the config value.
This fix addresses CVE-2022-2308.
Cc: [email protected] # v5.15+
Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace")
Reviewed-by: Xie Yongji
Acked-by: Jason Wang
Signed-off-by: Maxime Coquelin
Message-Id:
Signed-off-by: Michael S. Tsirkin
Reviewed-by: Chaitanya Kulkarni
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-09-01
Published