CVE-2022-49788: misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()
In the Linux kernel, the following vulnerability has been resolved:
misc/vmwvmci: fix an infoleak in vmcihostdoreceivedatagram()
struct vmcieventqp allocated by qpnotifypeer() contains padding, which may carry uninitialized data to the userspace, as observed by KMSAN:
BUG: KMSAN: kernel-infoleak in instrumentcopytouser ./include/linux/instrumented.h:121 instrumentcopytouser ./include/linux/instrumented.h:121 copytouser+0x5f/0xb0 lib/usercopy.c:33 copytouser ./include/linux/uaccess.h:169 vmcihostdoreceivedatagram drivers/misc/vmwvmci/vmcihost.c:431 vmcihostunlockedioctl+0x33d/0x43d0 drivers/misc/vmwvmci/vmcihost.c:925 vfsioctl fs/ioctl.c:51 ...
Uninit was stored to memory at: kmemdup+0x74/0xb0 mm/util.c:131 dgdispatchashost drivers/misc/vmwvmci/vmcidatagram.c:271 vmcidatagramdispatch+0x4f8/0xfc0 drivers/misc/vmwvmci/vmcidatagram.c:339 qpnotifypeer+0x19a/0x290 drivers/misc/vmwvmci/vmciqueuepair.c:1479 qpbrokerattach drivers/misc/vmwvmci/vmciqueuepair.c:1662 qpbrokeralloc+0x2977/0x2f30 drivers/misc/vmwvmci/vmciqueuepair.c:1750 vmciqpbrokeralloc+0x96/0xd0 drivers/misc/vmwvmci/vmciqueuepair.c:1940 vmcihostdoallocqueuepair drivers/misc/vmwvmci/vmcihost.c:488 vmcihostunlockedioctl+0x24fd/0x43d0 drivers/misc/vmwvmci/vmcihost.c:927 ...
Local variable ev created at: qpnotifypeer+0x54/0x290 drivers/misc/vmwvmci/vmciqueuepair.c:1456 qpbrokerattach drivers/misc/vmwvmci/vmciqueuepair.c:1662 qpbrokeralloc+0x2977/0x2f30 drivers/misc/vmwvmci/vmciqueuepair.c:1750
Bytes 28-31 of 48 are uninitialized Memory access of size 48 starts at ffff888035155e00 Data copied to user address 0000000020000100
Use memset() to prevent the infoleaks.
Also speculatively fix qpnotifypeerlocal(), which may suffer from the same problem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In qp_notify_peer(), initialize the padding/uninitialized bytes of the local variable ev (struct vmci_event_qp) using memset() before it is passed to copy_to_user via the _copy_to_user path (instrument_copy_to_user). This prevents the kernel-infoleak of Bytes 28-31 of 48 to userspace.
Linux kernel (drivers/misc/vmw_vmci/vmci_queue_pair.c: qp_notify_peer() / _copy_to_user path) Use memset() to initialize padding/uninitialized bytes in struct vmci_event_qp before copy_to_user = memset() padding/uninitialized fields to 0
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49788?
CVE-2022-49788 is classified as a medium severity vulnerability in the Linux kernel.
What impact does CVE-2022-49788 have on systems?
CVE-2022-49788 may allow uninitialized data to be exposed to user space, potentially leading to information disclosure.
How do I fix CVE-2022-49788?
To fix CVE-2022-49788, you should update your Linux kernel to a version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2022-49788?
CVE-2022-49788 affects certain versions of the Linux kernel, particularly those prior to the patches addressing this issue.
Is CVE-2022-49788 easy to exploit?
CVE-2022-49788 may require specific conditions or access to exploit, making it moderately challenging for an attacker.