In the Linux kernel, the following vulnerability has been resolved:
misc/vmwvmci: fix an infoleak in vmcihostdoreceive_datagram()
struct vmci_event_qp allocated by qpnotifypeer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:
BUG: KMSAN: kernel-infoleak in instrumentcopytouser ./include/linux/instrumented.h:121 instrumentcopytouser ./include/linux/instrumented.h:121 copytouser+0x5f/0xb0 lib/usercopy.c:33 copytouser ./include/linux/uaccess.h:169 vmcihostdoreceivedatagram drivers/misc/vmwvmci/vmcihost.c:431 vmcihostunlockedioctl+0x33d/0x43d0 drivers/misc/vmwvmci/vmcihost.c:925 vfs_ioctl fs/ioctl.c:51 ...
Uninit was stored to memory at: kmemdup+0x74/0xb0 mm/util.c:131 dgdispatchashost drivers/misc/vmwvmci/vmcidatagram.c:271 vmcidatagramdispatch+0x4f8/0xfc0 drivers/misc/vmwvmci/vmcidatagram.c:339 qpnotifypeer+0x19a/0x290 drivers/misc/vmwvmci/vmciqueuepair.c:1479 qpbrokerattach drivers/misc/vmwvmci/vmciqueuepair.c:1662 qpbrokeralloc+0x2977/0x2f30 drivers/misc/vmwvmci/vmciqueuepair.c:1750 vmciqpbrokeralloc+0x96/0xd0 drivers/misc/vmwvmci/vmciqueuepair.c:1940 vmcihostdoallocqueuepair drivers/misc/vmwvmci/vmcihost.c:488 vmcihostunlockedioctl+0x24fd/0x43d0 drivers/misc/vmwvmci/vmci_host.c:927 ...
Local variable ev created at: qpnotifypeer+0x54/0x290 drivers/misc/vmwvmci/vmciqueuepair.c:1456 qpbrokerattach drivers/misc/vmwvmci/vmciqueuepair.c:1662 qpbrokeralloc+0x2977/0x2f30 drivers/misc/vmwvmci/vmciqueue_pair.c:1750
Bytes 28-31 of 48 are uninitialized Memory access of size 48 starts at ffff888035155e00 Data copied to user address 0000000020000100
Use memset() to prevent the infoleaks.
Also speculatively fix qpnotifypeer_local(), which may suffer from the same problem.
[
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f04586c2315cfd03d72ad0395705435e7ed07b1a",
"deprecated": false,
"id": "CVE-2022-49788-05d4cc59",
"digest": {
"function_hash": "63857422984950391237516136831564175256",
"length": 531.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer_local",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7061dd1fef2dfb6458cd521aef27aa66f510d31",
"deprecated": false,
"id": "CVE-2022-49788-1c1fca69",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ccf7229b96fadc3a185d1391f814a604c7ef609",
"deprecated": false,
"id": "CVE-2022-49788-293fa535",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62634b43d3c4e1bf62fd540196f7081bf0885c0a",
"deprecated": false,
"id": "CVE-2022-49788-2c7e3e7d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a275528025ae4bc7e2232866856dfebf84b2fad",
"deprecated": false,
"id": "CVE-2022-49788-322b3238",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c50d77b928a33e5290aaa9fdc10e88254ff8c7",
"deprecated": false,
"id": "CVE-2022-49788-367e842b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ccf7229b96fadc3a185d1391f814a604c7ef609",
"deprecated": false,
"id": "CVE-2022-49788-3b18bfeb",
"digest": {
"function_hash": "305409483525910010601394762053899174207",
"length": 862.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d",
"deprecated": false,
"id": "CVE-2022-49788-3c36e6a7",
"digest": {
"function_hash": "63857422984950391237516136831564175256",
"length": 531.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer_local",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7061dd1fef2dfb6458cd521aef27aa66f510d31",
"deprecated": false,
"id": "CVE-2022-49788-64d58cc5",
"digest": {
"function_hash": "305409483525910010601394762053899174207",
"length": 862.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b0d06d9b10f5f43101bd6598b076c347f9295f",
"deprecated": false,
"id": "CVE-2022-49788-7f6fdf88",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a275528025ae4bc7e2232866856dfebf84b2fad",
"deprecated": false,
"id": "CVE-2022-49788-7fc4f260",
"digest": {
"function_hash": "63857422984950391237516136831564175256",
"length": 531.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer_local",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d",
"deprecated": false,
"id": "CVE-2022-49788-93bb8b2e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ccf7229b96fadc3a185d1391f814a604c7ef609",
"deprecated": false,
"id": "CVE-2022-49788-95272895",
"digest": {
"function_hash": "63857422984950391237516136831564175256",
"length": 531.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer_local",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b0d06d9b10f5f43101bd6598b076c347f9295f",
"deprecated": false,
"id": "CVE-2022-49788-96b731ac",
"digest": {
"function_hash": "305409483525910010601394762053899174207",
"length": 862.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a275528025ae4bc7e2232866856dfebf84b2fad",
"deprecated": false,
"id": "CVE-2022-49788-a09ffd71",
"digest": {
"function_hash": "305409483525910010601394762053899174207",
"length": 862.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d",
"deprecated": false,
"id": "CVE-2022-49788-ade05e81",
"digest": {
"function_hash": "305409483525910010601394762053899174207",
"length": 862.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62634b43d3c4e1bf62fd540196f7081bf0885c0a",
"deprecated": false,
"id": "CVE-2022-49788-b015880a",
"digest": {
"function_hash": "305409483525910010601394762053899174207",
"length": 862.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f04586c2315cfd03d72ad0395705435e7ed07b1a",
"deprecated": false,
"id": "CVE-2022-49788-be24a2a8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"signature_version": "v1",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f04586c2315cfd03d72ad0395705435e7ed07b1a",
"deprecated": false,
"id": "CVE-2022-49788-c7291a1c",
"digest": {
"function_hash": "305409483525910010601394762053899174207",
"length": 862.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c50d77b928a33e5290aaa9fdc10e88254ff8c7",
"deprecated": false,
"id": "CVE-2022-49788-c9be5d9f",
"digest": {
"function_hash": "305409483525910010601394762053899174207",
"length": 862.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62634b43d3c4e1bf62fd540196f7081bf0885c0a",
"deprecated": false,
"id": "CVE-2022-49788-ce73a67d",
"digest": {
"function_hash": "63857422984950391237516136831564175256",
"length": 531.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer_local",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c50d77b928a33e5290aaa9fdc10e88254ff8c7",
"deprecated": false,
"id": "CVE-2022-49788-d2cc28f2",
"digest": {
"function_hash": "63857422984950391237516136831564175256",
"length": 531.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer_local",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b0d06d9b10f5f43101bd6598b076c347f9295f",
"deprecated": false,
"id": "CVE-2022-49788-f51b7491",
"digest": {
"function_hash": "63857422984950391237516136831564175256",
"length": 531.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer_local",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7061dd1fef2dfb6458cd521aef27aa66f510d31",
"deprecated": false,
"id": "CVE-2022-49788-fbdf5185",
"digest": {
"function_hash": "63857422984950391237516136831564175256",
"length": 531.0
},
"signature_version": "v1",
"target": {
"function": "qp_notify_peer_local",
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
}
]