Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-50709

wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with pkt_len = 0 but ath9k_hif_usb_rx_stream() uses __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that pkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb with uninitialized memory and ath9k_htc_rx_msg() is reading from uninitialized memory. Since bytes accessed by ath9k_htc_rx_msg() is not known until ath9k_htc_rx_msg() is called, it would be difficult to check minimal valid pkt_len at "if (pkt_len > 2 * MAX_RX_BUF_SIZE) {" line in ath9k_hif_usb_rx_stream(). We have two choices. One is to workaround by adding __GFP_ZERO so that ath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to let ath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose the latter. Note that I'm not sure threshold condition is correct, for I can't find details on possible packet length used by this protocol.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • fb9987d0f748c983bb795a86f47522313f701a08 to < f3d2a3b7e290d0bdbddfcee5a6c3d922e2b7e02aaffected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 84242f15f911f34aec9b22f99d1e9bff19723dbeaffected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 2c485f4f2a64258acc5228e78ffb828c68d9e770affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 9661724f6206bd606ecf13acada676a9975d230baffected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < b1b4144508adfc585e43856b31baaf9008a3beb4affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 0d2649b288b7b9484e3d4380c0d6c4720a17e473affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < 4891a50f5ed8bfcb8f2a4b816b0676f398687783affected
  • fb9987d0f748c983bb795a86f47522313f701a08 to < b383e8abed41cc6ff1a3b34de75df9397fa4878caffected

Linux Linux

Default version status: affected

  • 2.6.35affected
  • 0 to < 2.6.35unaffected
  • 4.14.296 to ≤ 4.14.*unaffected
  • 4.19.262 to ≤ 4.19.*unaffected
  • 5.4.220 to ≤ 5.4.*unaffected
  • 5.10.150 to ≤ 5.10.*unaffected
  • 5.15.75 to ≤ 5.15.*unaffected
  • 5.19.17 to ≤ 5.19.*unaffected
  • 6.0.3 to ≤ 6.0.*unaffected
  • 6.1 to ≤ *unaffected

References