CVE-2022-0494: Infoleak
A flaw was found in the linux kernel in scsiioctl() function. If the parameter cmd is SCSIIOCTLSENDCOMMAND, the function scsiioctl will call sgscsiioctl to further process. In function sgscsiioctl, it creates a scsi request and calls blkrqmapkern to allocate the internal buffer of this request, but the internal buffer doesn't get zeroed properly. Then this request will be sent to the disk driver, but the disk driver doesn't fill anything into it. Finally, the internal buffer's content is copied to the user buffer which is specified by the parameter sic->data of sgscsiioctl.
Reference: https://lore.kernel.org/all/20220216084038.15635-1-tcs.kernel@gmail.com/
Other sources
A kernel information leak flaw was identified in the scsiioctl function in drivers/scsi/scsiioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAPSYSADMIN or CAPSYSRAWIO) to create issues with confidentiality.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-0494?
The severity of CVE-2022-0494 is classified as high due to its potential to lead to privilege escalation.
How do I fix CVE-2022-0494?
To fix CVE-2022-0494, update your kernel to one of the following versions: 0:4.18.0-372.32.1.rt7.189.el8_6, 0:4.18.0-372.32.1.el8_6, 0:5.14.0-70.22.1.el9_0, or any version above 5.17.
What systems are affected by CVE-2022-0494?
CVE-2022-0494 affects Linux kernel versions up to 5.17 and specific Red Hat and Debian kernel packages.
Can CVE-2022-0494 lead to remote code execution?
CVE-2022-0494 does not directly lead to remote code execution but may allow privilege escalation, which can be exploited in conjunction with other vulnerabilities.
Is there a workaround for CVE-2022-0494?
There are no specific workarounds for CVE-2022-0494; the best mitigation is to apply the recommended updates to affected kernel versions.