In the Linux kernel, the following vulnerability has been resolved:
ath9k_htc: fix uninit value bugs
Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization.
In htcconnectservice() svcmetalen and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svcmetalen to 0.
htcissuesend() does not initialize htcframehdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy
Fail logs:
BUG: KMSAN: kernel-usb-infoleak in usbsubmiturb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usbsubmiturb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hifusbsendregout drivers/net/wireless/ath/ath9k/hifusb.c:127 [inline] hifusbsend+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hifusb.c:479 htcissuesend drivers/net/wireless/ath/ath9k/htchst.c:34 [inline] htcconnectservice+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ...
Uninit was created at: slabpostallochook mm/slab.h:524 [inline] slaballocnode mm/slub.c:3251 [inline] _kmallocnodetrackcaller+0xe0c/0x1510 mm/slub.c:4974 kmallocreserve net/core/skbuff.c:354 [inline] _allocskb+0x545/0xf90 net/core/skbuff.c:426 allocskb include/linux/skbuff.h:1126 [inline] htcconnectservice+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htchst.c:258 ...
Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00
BUG: KMSAN: kernel-usb-infoleak in usbsubmiturb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usbsubmiturb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hifusbsendregout drivers/net/wireless/ath/ath9k/hifusb.c:127 [inline] hifusbsend+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hifusb.c:479 htcissuesend drivers/net/wireless/ath/ath9k/htchst.c:34 [inline] htcconnectservice+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ...
Uninit was created at: slabpostallochook mm/slab.h:524 [inline] slaballocnode mm/slub.c:3251 [inline] _kmallocnodetrackcaller+0xe0c/0x1510 mm/slub.c:4974 kmallocreserve net/core/skbuff.c:354 [inline] _allocskb+0x545/0xf90 net/core/skbuff.c:426 allocskb include/linux/skbuff.h:1126 [inline] htcconnectservice+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htchst.c:258 ...
Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-15d80445",
"signature_version": "v1",
"digest": {
"function_hash": "247436675095088478705837488032074461163",
"length": 1444.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-235fc734",
"signature_version": "v1",
"digest": {
"line_hashes": [
"272619029071501420427423864861605480687",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7da6169b6ebb75816b57be3beb829afa74f3b4b6",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-3b70049c",
"signature_version": "v1",
"digest": {
"function_hash": "267509564670824151863456743783212985353",
"length": 398.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b700f7d06492de34964b6f414120043364f8191",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-3df6d7e1",
"signature_version": "v1",
"digest": {
"function_hash": "267509564670824151863456743783212985353",
"length": 398.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5abf2b761b998063f5e2bae93fd4ab10e2a80f10",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-419ec235",
"signature_version": "v1",
"digest": {
"function_hash": "231647406874938298439530642714111171427",
"length": 1408.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4222052a76559c20e821bc3519cefb58b6d3e9",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-527359e6",
"signature_version": "v1",
"digest": {
"line_hashes": [
"219955185602428251257730352223332732803",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1e0df1c57bd30871dd1c855742a7c346dbca853",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-5fec51d3",
"signature_version": "v1",
"digest": {
"function_hash": "231647406874938298439530642714111171427",
"length": 1408.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d244b731188e0b63fc40a9d2dec72e9181fb37c",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-65118383",
"signature_version": "v1",
"digest": {
"line_hashes": [
"219955185602428251257730352223332732803",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b700f7d06492de34964b6f414120043364f8191",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-7461eb56",
"signature_version": "v1",
"digest": {
"function_hash": "231647406874938298439530642714111171427",
"length": 1408.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e352acdd378e9263cc4c6018e588f2dac7161d07",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-78cf96fc",
"signature_version": "v1",
"digest": {
"line_hashes": [
"219955185602428251257730352223332732803",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f11ac281f0c0b363d2940204f28bae0422ed71",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-7bae537c",
"signature_version": "v1",
"digest": {
"function_hash": "267509564670824151863456743783212985353",
"length": 398.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1e0df1c57bd30871dd1c855742a7c346dbca853",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-883cdfed",
"signature_version": "v1",
"digest": {
"line_hashes": [
"219955185602428251257730352223332732803",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-9242cfad",
"signature_version": "v1",
"digest": {
"function_hash": "88628702839601709297973011667625017583",
"length": 410.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f11ac281f0c0b363d2940204f28bae0422ed71",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-967f1910",
"signature_version": "v1",
"digest": {
"function_hash": "231647406874938298439530642714111171427",
"length": 1408.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4222052a76559c20e821bc3519cefb58b6d3e9",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-97050f74",
"signature_version": "v1",
"digest": {
"function_hash": "267509564670824151863456743783212985353",
"length": 398.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4222052a76559c20e821bc3519cefb58b6d3e9",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-98b465a9",
"signature_version": "v1",
"digest": {
"function_hash": "324003572812736602611487299400166096053",
"length": 1427.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11f11ac281f0c0b363d2940204f28bae0422ed71",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-9c571a7b",
"signature_version": "v1",
"digest": {
"line_hashes": [
"219955185602428251257730352223332732803",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5abf2b761b998063f5e2bae93fd4ab10e2a80f10",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-9e593249",
"signature_version": "v1",
"digest": {
"function_hash": "267509564670824151863456743783212985353",
"length": 398.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7da6169b6ebb75816b57be3beb829afa74f3b4b6",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-b33e4f15",
"signature_version": "v1",
"digest": {
"function_hash": "231647406874938298439530642714111171427",
"length": 1408.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e352acdd378e9263cc4c6018e588f2dac7161d07",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-bd8b754e",
"signature_version": "v1",
"digest": {
"function_hash": "324003572812736602611487299400166096053",
"length": 1427.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7da6169b6ebb75816b57be3beb829afa74f3b4b6",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-c05db9c2",
"signature_version": "v1",
"digest": {
"line_hashes": [
"219955185602428251257730352223332732803",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e352acdd378e9263cc4c6018e588f2dac7161d07",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-d0fb612e",
"signature_version": "v1",
"digest": {
"function_hash": "267509564670824151863456743783212985353",
"length": 398.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d244b731188e0b63fc40a9d2dec72e9181fb37c",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-d542190f",
"signature_version": "v1",
"digest": {
"function_hash": "267509564670824151863456743783212985353",
"length": 398.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1e0df1c57bd30871dd1c855742a7c346dbca853",
"target": {
"function": "htc_issue_send",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-d5aaed53",
"signature_version": "v1",
"digest": {
"function_hash": "267509564670824151863456743783212985353",
"length": 398.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b700f7d06492de34964b6f414120043364f8191",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-e5a8f8a8",
"signature_version": "v1",
"digest": {
"line_hashes": [
"219955185602428251257730352223332732803",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5abf2b761b998063f5e2bae93fd4ab10e2a80f10",
"target": {
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2022-49235-e9bfba76",
"signature_version": "v1",
"digest": {
"line_hashes": [
"219955185602428251257730352223332732803",
"167816492882786394258243392069556902760",
"37387192254571099978528775065264450716",
"228201050686938628942975056052441391979",
"55357588063004343794581657219986225625",
"229200573395886674249095708810762480958",
"278024283331996236804770618729210889494"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4d244b731188e0b63fc40a9d2dec72e9181fb37c",
"target": {
"function": "htc_connect_service",
"file": "drivers/net/wireless/ath/ath9k/htc_hst.c"
},
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2022-49235-ff591171",
"signature_version": "v1",
"digest": {
"function_hash": "231647406874938298439530642714111171427",
"length": 1408.0
}
}
]