Skip to content
CVE PROGRAM SOURCE RECORD5.5 Medium

CVE-2022-49235

ath9k_htc: fix uninit value bugs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fb9987d0f748c983bb795a86f47522313f701a08 to < 5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < e352acdd378e9263cc4c6018e588f2dac7161d07affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < ee4222052a76559c20e821bc3519cefb58b6d3e9affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 4d244b731188e0b63fc40a9d2dec72e9181fb37caffected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 11f11ac281f0c0b363d2940204f28bae0422ed71affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 0b700f7d06492de34964b6f414120043364f8191affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 7da6169b6ebb75816b57be3beb829afa74f3b4b6affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 5abf2b761b998063f5e2bae93fd4ab10e2a80f10affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < d1e0df1c57bd30871dd1c855742a7c346dbca853affected

Linux Linux

Default version status: affected

  • 2.6.35affected
  • 0 to < 2.6.35unaffected
  • 4.9.311 to ≤ 4.9.*unaffected
  • 4.14.276 to ≤ 4.14.*unaffected
  • 4.19.238 to ≤ 4.19.*unaffected
  • 5.4.189 to ≤ 5.4.*unaffected
  • 5.10.110 to ≤ 5.10.*unaffected
  • 5.15.33 to ≤ 5.15.*unaffected
  • 5.16.19 to ≤ 5.16.*unaffected
  • 5.17.2 to ≤ 5.17.*unaffected
  • 5.18 to ≤ *unaffected

References