In the Linux kernel, the following vulnerability has been resolved:
misc/vmwvmci: fix an infoleak in vmcihostdoreceive_datagram()
struct vmci_event_qp allocated by qpnotifypeer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:
BUG: KMSAN: kernel-infoleak in instrumentcopytouser ./include/linux/instrumented.h:121 instrumentcopytouser ./include/linux/instrumented.h:121 copytouser+0x5f/0xb0 lib/usercopy.c:33 copytouser ./include/linux/uaccess.h:169 vmcihostdoreceivedatagram drivers/misc/vmwvmci/vmcihost.c:431 vmcihostunlockedioctl+0x33d/0x43d0 drivers/misc/vmwvmci/vmcihost.c:925 vfs_ioctl fs/ioctl.c:51 ...
Uninit was stored to memory at: kmemdup+0x74/0xb0 mm/util.c:131 dgdispatchashost drivers/misc/vmwvmci/vmcidatagram.c:271 vmcidatagramdispatch+0x4f8/0xfc0 drivers/misc/vmwvmci/vmcidatagram.c:339 qpnotifypeer+0x19a/0x290 drivers/misc/vmwvmci/vmciqueuepair.c:1479 qpbrokerattach drivers/misc/vmwvmci/vmciqueuepair.c:1662 qpbrokeralloc+0x2977/0x2f30 drivers/misc/vmwvmci/vmciqueuepair.c:1750 vmciqpbrokeralloc+0x96/0xd0 drivers/misc/vmwvmci/vmciqueuepair.c:1940 vmcihostdoallocqueuepair drivers/misc/vmwvmci/vmcihost.c:488 vmcihostunlockedioctl+0x24fd/0x43d0 drivers/misc/vmwvmci/vmci_host.c:927 ...
Local variable ev created at: qpnotifypeer+0x54/0x290 drivers/misc/vmwvmci/vmciqueuepair.c:1456 qpbrokerattach drivers/misc/vmwvmci/vmciqueuepair.c:1662 qpbrokeralloc+0x2977/0x2f30 drivers/misc/vmwvmci/vmciqueue_pair.c:1750
Bytes 28-31 of 48 are uninitialized Memory access of size 48 starts at ffff888035155e00 Data copied to user address 0000000020000100
Use memset() to prevent the infoleaks.
Also speculatively fix qpnotifypeer_local(), which may suffer from the same problem.
[
{
"id": "CVE-2022-49788-3c36e6a7",
"signature_version": "v1",
"digest": {
"length": 531.0,
"function_hash": "63857422984950391237516136831564175256"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c",
"function": "qp_notify_peer_local"
}
},
{
"id": "CVE-2022-49788-93bb8b2e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"209655890880633366552970355406167722262",
"330698285898390997907438196163819624920",
"316367586982842170453554547481226388991",
"321601698541616732922221037046849824578",
"281779678970173230314234052935964926944",
"4753814807728668592887997385900125890"
]
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c"
}
},
{
"id": "CVE-2022-49788-ade05e81",
"signature_version": "v1",
"digest": {
"length": 862.0,
"function_hash": "305409483525910010601394762053899174207"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d",
"target": {
"file": "drivers/misc/vmw_vmci/vmci_queue_pair.c",
"function": "qp_notify_peer"
}
}
]