CVE-2022-49235
published 2025-02-26CVE-2022-49235: In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.27%
19.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
ath9k_htc: fix uninit value bugs
Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
field initialization.
In htc_connect_service() svc_meta_len and pad are not initialized. Based
on code it looks like in current skb there is no service data, so simply
initialize svc_meta_len to 0.
htc_issue_send() does not initialize htc_frame_hdr::control array. Based
on firmware code, it will initialize it by itself, so simply zero whole
array to make KMSAN happy
Fail logs:
BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
...
Uninit was created at:
slab_post_alloc_hook mm/slab.h:524 [inline]
slab_alloc_node mm/slub.c:3251 [inline]
__kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
kmalloc_reserve net/core/skbuff.c:354 [inline]
__alloc_skb+0x545/0xf90 net/core/skbuff.c:426
alloc_skb include/linux/skbuff.h:1126 [inline]
htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
...
Bytes 4-7 of 18 are uninitialized
Memory access of size 18 starts at ffff888027377e00
BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
...
Uninit was created at:
slab_post_alloc_hook mm/slab.h:524 [inline]
slab_alloc_node
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.3-1 (bookworm) | linux 5.17.3-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9 | 5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < e352acdd378e9263cc4c6018e588f2dac7161d07 | e352acdd378e9263cc4c6018e588f2dac7161d07 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < ee4222052a76559c20e821bc3519cefb58b6d3e9 | ee4222052a76559c20e821bc3519cefb58b6d3e9 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 4d244b731188e0b63fc40a9d2dec72e9181fb37c | 4d244b731188e0b63fc40a9d2dec72e9181fb37c |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 11f11ac281f0c0b363d2940204f28bae0422ed71 | 11f11ac281f0c0b363d2940204f28bae0422ed71 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 0b700f7d06492de34964b6f414120043364f8191 | 0b700f7d06492de34964b6f414120043364f8191 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 7da6169b6ebb75816b57be3beb829afa74f3b4b6 | 7da6169b6ebb75816b57be3beb829afa74f3b4b6 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < 5abf2b761b998063f5e2bae93fd4ab10e2a80f10 | 5abf2b761b998063f5e2bae93fd4ab10e2a80f10 |
| linux | linux | >= fb9987d0f748c983bb795a86f47522313f701a08 < d1e0df1c57bd30871dd1c855742a7c346dbca853 | d1e0df1c57bd30871dd1c855742a7c346dbca853 |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 0 < 5.17.3-1 | 5.17.3-1 |
| linux | linux_kernel | >= 2.6.35 < 4.9.311 | 4.9.311 |
| linux | linux_kernel | >= 4.10 < 4.14.276 | 4.14.276 |
| linux | linux_kernel | >= 4.15 < 4.19.238 | 4.19.238 |
| linux | linux_kernel | >= 4.20 < 5.4.189 | 5.4.189 |
| linux | linux_kernel | >= 5.11 < 5.15.33 | 5.15.33 |
| linux | linux_kernel | >= 5.16 < 5.16.19 | 5.16.19 |
| linux | linux_kernel | >= 5.17 < 5.17.2 | 5.17.2 |
| linux | linux_kernel | >= 5.5 < 5.10.110 | 5.10.110 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3w7q-wchx-rf5p: In the Linux kernel, the following vulnerability has been resolved:
ath9k_htc: fix uninit value bugs
Syzbot reported 2 KMSAN bugs in ath9k
ghsa_unreviewed·2025-03-18
CVE-2022-49235 [MEDIUM] CWE-908 GHSA-3w7q-wchx-rf5p: In the Linux kernel, the following vulnerability has been resolved:
ath9k_htc: fix uninit value bugs
Syzbot reported 2 KMSAN bugs in ath9k
In the Linux kernel, the following vulnerability has been resolved:
ath9k_htc: fix uninit value bugs
Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
field initialization.
In htc_connect_service() svc_meta_len and pad are not initialized. Based
on code it looks like in current skb there is no service data, so simply
initialize svc_meta_len to 0.
htc_issue_send() does not initialize htc_frame_hdr::control array. Based
on firmware code, it will initialize it by itself, so simply zero whole
array to make KMSAN happy
Fail logs:
BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
hif_usb_send+0x5f0/0x
OSV
CVE-2022-49235: In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k
osv·2025-02-26·CVSS 5.5
CVE-2022-49235 [MEDIUM] CVE-2022-49235: In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k
In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 d
Red Hat
kernel: ath9k_htc: fix uninit value bugs
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49235 [MEDIUM] CWE-908 kernel: ath9k_htc: fix uninit value bugs
kernel: ath9k_htc: fix uninit value bugs
In the Linux kernel, the following vulnerability has been resolved:
ath9k_htc: fix uninit value bugs
Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
field initialization.
In htc_connect_service() svc_meta_len and pad are not initialized. Based
on code it looks like in current skb there is no service data, so simply
initialize svc_meta_len to 0.
htc_issue_send() does not initialize htc_frame_hdr::control array. Based
on firmware code, it will initialize it by itself, so simply zero whole
array to make KMSAN happy
Fail logs:
BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.
Debian
CVE-2022-49235: linux - In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: ...
vendor_debian·2022·CVSS 5.5
CVE-2022-49235 [MEDIUM] CVE-2022-49235: linux - In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: ...
In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 d
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0b700f7d06492de34964b6f414120043364f8191https://git.kernel.org/stable/c/11f11ac281f0c0b363d2940204f28bae0422ed71https://git.kernel.org/stable/c/4d244b731188e0b63fc40a9d2dec72e9181fb37chttps://git.kernel.org/stable/c/5abf2b761b998063f5e2bae93fd4ab10e2a80f10https://git.kernel.org/stable/c/5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9https://git.kernel.org/stable/c/7da6169b6ebb75816b57be3beb829afa74f3b4b6https://git.kernel.org/stable/c/d1e0df1c57bd30871dd1c855742a7c346dbca853https://git.kernel.org/stable/c/e352acdd378e9263cc4c6018e588f2dac7161d07https://git.kernel.org/stable/c/ee4222052a76559c20e821bc3519cefb58b6d3e9
2025-02-26
Published