In the Linux kernel, the following vulnerability has been resolved:
staging: rtl8712: fix uninit-value in usb_read8() and friends
When r8712usbctrlvendorreq() returns negative, 'data' in usb_read{8,16,32} will not be initialized.
BUG: KMSAN: uninit-value in stringnocheck lib/vsprintf.c:643 [inline] BUG: KMSAN: uninit-value in string+0x4ec/0x6f0 lib/vsprintf.c:725 stringnocheck lib/vsprintf.c:643 [inline] string+0x4ec/0x6f0 lib/vsprintf.c:725 vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806 vaformat lib/vsprintf.c:1704 [inline] pointer+0x18e6/0x1f70 lib/vsprintf.c:2443 vsnprintf+0x1a9b/0x3650 lib/vsprintf.c:2810 vprintkstore+0x537/0x2150 kernel/printk/printk.c:2158 vprintkemit+0x28b/0xab0 kernel/printk/printk.c:2256 devvprintkemit+0x5ef/0x6d0 drivers/base/core.c:4604 devprintkemit+0x1dd/0x21f drivers/base/core.c:4615 _devprintk+0x3be/0x440 drivers/base/core.c:4627 _devinfo+0x1ea/0x22f drivers/base/core.c:4673 r871xudrvinit+0x1929/0x3070 drivers/staging/rtl8712/usbintf.c:401 usbprobeinterface+0xf19/0x1600 drivers/usb/core/driver.c:396 reallyprobe+0x6c7/0x1350 drivers/base/dd.c:621 _driverprobedevice+0x3e9/0x530 drivers/base/dd.c:752 driverprobedevice drivers/base/dd.c:782 [inline] _deviceattachdriver+0x79f/0x1120 drivers/base/dd.c:899 busforeachdrv+0x2d6/0x3f0 drivers/base/bus.c:427 _deviceattach+0x593/0x8e0 drivers/base/dd.c:970 deviceinitialprobe+0x4a/0x60 drivers/base/dd.c:1017 busprobedevice+0x17b/0x3e0 drivers/base/bus.c:487 deviceadd+0x1fff/0x26e0 drivers/base/core.c:3405 usbsetconfiguration+0x37e9/0x3ed0 drivers/usb/core/message.c:2170 usbgenericdriverprobe+0x13c/0x300 drivers/usb/core/generic.c:238 usbprobedevice+0x309/0x570 drivers/usb/core/driver.c:293 reallyprobe+0x6c7/0x1350 drivers/base/dd.c:621 _driverprobedevice+0x3e9/0x530 drivers/base/dd.c:752 driverprobedevice drivers/base/dd.c:782 [inline] _deviceattachdriver+0x79f/0x1120 drivers/base/dd.c:899 busforeachdrv+0x2d6/0x3f0 drivers/base/bus.c:427 _deviceattach+0x593/0x8e0 drivers/base/dd.c:970 deviceinitialprobe+0x4a/0x60 drivers/base/dd.c:1017 busprobedevice+0x17b/0x3e0 drivers/base/bus.c:487 deviceadd+0x1fff/0x26e0 drivers/base/core.c:3405 usbnewdevice+0x1b91/0x2950 drivers/usb/core/hub.c:2566 hubportconnect drivers/usb/core/hub.c:5363 [inline] hubportconnectchange drivers/usb/core/hub.c:5507 [inline] portevent drivers/usb/core/hub.c:5665 [inline] hubevent+0x58e3/0x89e0 drivers/usb/core/hub.c:5747 processonework+0xdb6/0x1820 kernel/workqueue.c:2289 workerthread+0x10d0/0x2240 kernel/workqueue.c:2436 kthread+0x3c7/0x500 kernel/kthread.c:376 retfromfork+0x1f/0x30
Local variable data created at: usbread8+0x5d/0x130 drivers/staging/rtl8712/usbops.c:33 r8712read8+0xa5/0xd0 drivers/staging/rtl8712/rtl8712io.c:29
KMSAN: uninit-value in r871xudrvinit https://syzkaller.appspot.com/bug?id=3cd92b1d85428b128503bfa7a250294c9ae00bd8
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1b57669732d09da7e13ef86d058dab0cd57f6e0",
"id": "CVE-2022-49301-02f92f8b",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read8",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 356.0,
"function_hash": "118842900994605106688517469010193955965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1b57669732d09da7e13ef86d058dab0cd57f6e0",
"id": "CVE-2022-49301-3d3f088f",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"51764246606522852824944475625905857303",
"307060594575360053134133183743823556957",
"331969897852111578388901309763396255358",
"211019499499753369828683206563301637670",
"130093601355608572532764615491696735843",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"113241256572394472074354356917307924109",
"311732918194037185558306157103885655254",
"282130358091527403665934175345317426229",
"318780052257312862451285687920982792917",
"200930012513661930736407003183325137533",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"275537769887215030446522017918832325503",
"291812473548118511410373709331258545161",
"311436165072856381683502916286528275372",
"248582550554637271006618256069808448763",
"263673917959397821889985822164265529120"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33ef21d55418ab6a62a63fd550b2dbe297433372",
"id": "CVE-2022-49301-4180b2a3",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"51764246606522852824944475625905857303",
"307060594575360053134133183743823556957",
"331969897852111578388901309763396255358",
"211019499499753369828683206563301637670",
"130093601355608572532764615491696735843",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"113241256572394472074354356917307924109",
"311732918194037185558306157103885655254",
"282130358091527403665934175345317426229",
"318780052257312862451285687920982792917",
"200930012513661930736407003183325137533",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"275537769887215030446522017918832325503",
"291812473548118511410373709331258545161",
"311436165072856381683502916286528275372",
"248582550554637271006618256069808448763",
"263673917959397821889985822164265529120"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de075af8c404f7d59ed34df230aedd9f645fb846",
"id": "CVE-2022-49301-47a29fcf",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read32",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 334.0,
"function_hash": "257410120333456230332546384146627852462"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95b0f54f8a898072a2810c05fab34d971f23a612",
"id": "CVE-2022-49301-4a669065",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read8",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 356.0,
"function_hash": "118842900994605106688517469010193955965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7ed3c85da0b230bcdf5329acfe012ed093f3daa",
"id": "CVE-2022-49301-74749a5b",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read8",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 356.0,
"function_hash": "118842900994605106688517469010193955965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95b0f54f8a898072a2810c05fab34d971f23a612",
"id": "CVE-2022-49301-7c86539b",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read16",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 357.0,
"function_hash": "266197992460575183333868886490830056980"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95b0f54f8a898072a2810c05fab34d971f23a612",
"id": "CVE-2022-49301-88156745",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read32",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 334.0,
"function_hash": "257410120333456230332546384146627852462"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7ed3c85da0b230bcdf5329acfe012ed093f3daa",
"id": "CVE-2022-49301-88f151ff",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read32",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 334.0,
"function_hash": "257410120333456230332546384146627852462"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7ed3c85da0b230bcdf5329acfe012ed093f3daa",
"id": "CVE-2022-49301-8b09ebb0",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"51764246606522852824944475625905857303",
"307060594575360053134133183743823556957",
"331969897852111578388901309763396255358",
"211019499499753369828683206563301637670",
"130093601355608572532764615491696735843",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"113241256572394472074354356917307924109",
"311732918194037185558306157103885655254",
"282130358091527403665934175345317426229",
"318780052257312862451285687920982792917",
"200930012513661930736407003183325137533",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"275537769887215030446522017918832325503",
"291812473548118511410373709331258545161",
"311436165072856381683502916286528275372",
"248582550554637271006618256069808448763",
"263673917959397821889985822164265529120"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95b0f54f8a898072a2810c05fab34d971f23a612",
"id": "CVE-2022-49301-8f6a8404",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"51764246606522852824944475625905857303",
"307060594575360053134133183743823556957",
"331969897852111578388901309763396255358",
"211019499499753369828683206563301637670",
"130093601355608572532764615491696735843",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"113241256572394472074354356917307924109",
"311732918194037185558306157103885655254",
"282130358091527403665934175345317426229",
"318780052257312862451285687920982792917",
"200930012513661930736407003183325137533",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"275537769887215030446522017918832325503",
"291812473548118511410373709331258545161",
"311436165072856381683502916286528275372",
"248582550554637271006618256069808448763",
"263673917959397821889985822164265529120"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de075af8c404f7d59ed34df230aedd9f645fb846",
"id": "CVE-2022-49301-97c6ce75",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"51764246606522852824944475625905857303",
"307060594575360053134133183743823556957",
"331969897852111578388901309763396255358",
"211019499499753369828683206563301637670",
"130093601355608572532764615491696735843",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"113241256572394472074354356917307924109",
"311732918194037185558306157103885655254",
"282130358091527403665934175345317426229",
"318780052257312862451285687920982792917",
"200930012513661930736407003183325137533",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"275537769887215030446522017918832325503",
"291812473548118511410373709331258545161",
"311436165072856381683502916286528275372",
"248582550554637271006618256069808448763",
"263673917959397821889985822164265529120"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33ef21d55418ab6a62a63fd550b2dbe297433372",
"id": "CVE-2022-49301-a7323020",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read8",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 356.0,
"function_hash": "118842900994605106688517469010193955965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58762f1c63c75cbe1dc393eed3c9cf8e38310ca1",
"id": "CVE-2022-49301-a9b38663",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read8",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 356.0,
"function_hash": "118842900994605106688517469010193955965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58762f1c63c75cbe1dc393eed3c9cf8e38310ca1",
"id": "CVE-2022-49301-ae4c9e29",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read32",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 334.0,
"function_hash": "257410120333456230332546384146627852462"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33ef21d55418ab6a62a63fd550b2dbe297433372",
"id": "CVE-2022-49301-b3f53731",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read32",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 334.0,
"function_hash": "257410120333456230332546384146627852462"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58762f1c63c75cbe1dc393eed3c9cf8e38310ca1",
"id": "CVE-2022-49301-b788d053",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read16",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 357.0,
"function_hash": "266197992460575183333868886490830056980"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de075af8c404f7d59ed34df230aedd9f645fb846",
"id": "CVE-2022-49301-cb7b7fb9",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read16",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 357.0,
"function_hash": "266197992460575183333868886490830056980"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1b57669732d09da7e13ef86d058dab0cd57f6e0",
"id": "CVE-2022-49301-d76a4dfd",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read16",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 357.0,
"function_hash": "266197992460575183333868886490830056980"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33ef21d55418ab6a62a63fd550b2dbe297433372",
"id": "CVE-2022-49301-de108f2a",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read16",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 357.0,
"function_hash": "266197992460575183333868886490830056980"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@58762f1c63c75cbe1dc393eed3c9cf8e38310ca1",
"id": "CVE-2022-49301-e8046ad7",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"51764246606522852824944475625905857303",
"307060594575360053134133183743823556957",
"331969897852111578388901309763396255358",
"211019499499753369828683206563301637670",
"130093601355608572532764615491696735843",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"113241256572394472074354356917307924109",
"311732918194037185558306157103885655254",
"282130358091527403665934175345317426229",
"318780052257312862451285687920982792917",
"200930012513661930736407003183325137533",
"34600121021130046333674305370794573645",
"119070034665353816418420980767236384830",
"94514263357445104385756295311111535627",
"19271644925170131050525107312970379553",
"275537769887215030446522017918832325503",
"291812473548118511410373709331258545161",
"311436165072856381683502916286528275372",
"248582550554637271006618256069808448763",
"263673917959397821889985822164265529120"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de075af8c404f7d59ed34df230aedd9f645fb846",
"id": "CVE-2022-49301-e82dd95a",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read8",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 356.0,
"function_hash": "118842900994605106688517469010193955965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d1b57669732d09da7e13ef86d058dab0cd57f6e0",
"id": "CVE-2022-49301-f5b6e0bb",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read32",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 334.0,
"function_hash": "257410120333456230332546384146627852462"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d7ed3c85da0b230bcdf5329acfe012ed093f3daa",
"id": "CVE-2022-49301-f68ed2eb",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "usb_read16",
"file": "drivers/staging/rtl8712/usb_ops.c"
},
"digest": {
"length": 357.0,
"function_hash": "266197992460575183333868886490830056980"
},
"signature_type": "Function"
}
]