In the Linux kernel, the following vulnerability has been resolved:
misc/vmwvmci: fix an infoleak in vmcihostdoreceive_datagram()
struct vmci_event_qp
allocated by qpnotifypeer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:
BUG: KMSAN: kernel-infoleak in instrumentcopytouser ./include/linux/instrumented.h:121 instrumentcopytouser ./include/linux/instrumented.h:121 copytouser+0x5f/0xb0 lib/usercopy.c:33 copytouser ./include/linux/uaccess.h:169 vmcihostdoreceivedatagram drivers/misc/vmwvmci/vmcihost.c:431 vmcihostunlockedioctl+0x33d/0x43d0 drivers/misc/vmwvmci/vmcihost.c:925 vfs_ioctl fs/ioctl.c:51 ...
Uninit was stored to memory at: kmemdup+0x74/0xb0 mm/util.c:131 dgdispatchashost drivers/misc/vmwvmci/vmcidatagram.c:271 vmcidatagramdispatch+0x4f8/0xfc0 drivers/misc/vmwvmci/vmcidatagram.c:339 qpnotifypeer+0x19a/0x290 drivers/misc/vmwvmci/vmciqueuepair.c:1479 qpbrokerattach drivers/misc/vmwvmci/vmciqueuepair.c:1662 qpbrokeralloc+0x2977/0x2f30 drivers/misc/vmwvmci/vmciqueuepair.c:1750 vmciqpbrokeralloc+0x96/0xd0 drivers/misc/vmwvmci/vmciqueuepair.c:1940 vmcihostdoallocqueuepair drivers/misc/vmwvmci/vmcihost.c:488 vmcihostunlockedioctl+0x24fd/0x43d0 drivers/misc/vmwvmci/vmci_host.c:927 ...
Local variable ev created at: qpnotifypeer+0x54/0x290 drivers/misc/vmwvmci/vmciqueuepair.c:1456 qpbrokerattach drivers/misc/vmwvmci/vmciqueuepair.c:1662 qpbrokeralloc+0x2977/0x2f30 drivers/misc/vmwvmci/vmciqueue_pair.c:1750
Bytes 28-31 of 48 are uninitialized Memory access of size 48 starts at ffff888035155e00 Data copied to user address 0000000020000100
Use memset() to prevent the infoleaks.
Also speculatively fix qpnotifypeer_local(), which may suffer from the same problem.
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f04586c2315cfd03d72ad0395705435e7ed07b1a", "signature_version": "v1", "digest": { "length": 531.0, "function_hash": "63857422984950391237516136831564175256" }, "id": "CVE-2022-49788-05d4cc59", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer_local" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7061dd1fef2dfb6458cd521aef27aa66f510d31", "signature_version": "v1", "digest": { "line_hashes": [ "209655890880633366552970355406167722262", "330698285898390997907438196163819624920", "316367586982842170453554547481226388991", "321601698541616732922221037046849824578", "281779678970173230314234052935964926944", "4753814807728668592887997385900125890" ], "threshold": 0.9 }, "id": "CVE-2022-49788-1c1fca69", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c" }, "deprecated": false, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ccf7229b96fadc3a185d1391f814a604c7ef609", "signature_version": "v1", "digest": { "line_hashes": [ "209655890880633366552970355406167722262", "330698285898390997907438196163819624920", "316367586982842170453554547481226388991", "321601698541616732922221037046849824578", "281779678970173230314234052935964926944", "4753814807728668592887997385900125890" ], "threshold": 0.9 }, "id": "CVE-2022-49788-293fa535", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c" }, "deprecated": false, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62634b43d3c4e1bf62fd540196f7081bf0885c0a", "signature_version": "v1", "digest": { "line_hashes": [ "209655890880633366552970355406167722262", "330698285898390997907438196163819624920", "316367586982842170453554547481226388991", "321601698541616732922221037046849824578", "281779678970173230314234052935964926944", "4753814807728668592887997385900125890" ], "threshold": 0.9 }, "id": "CVE-2022-49788-2c7e3e7d", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c" }, "deprecated": false, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a275528025ae4bc7e2232866856dfebf84b2fad", "signature_version": "v1", "digest": { "line_hashes": [ "209655890880633366552970355406167722262", "330698285898390997907438196163819624920", "316367586982842170453554547481226388991", "321601698541616732922221037046849824578", "281779678970173230314234052935964926944", "4753814807728668592887997385900125890" ], "threshold": 0.9 }, "id": "CVE-2022-49788-322b3238", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c" }, "deprecated": false, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c50d77b928a33e5290aaa9fdc10e88254ff8c7", "signature_version": "v1", "digest": { "line_hashes": [ "209655890880633366552970355406167722262", "330698285898390997907438196163819624920", "316367586982842170453554547481226388991", "321601698541616732922221037046849824578", "281779678970173230314234052935964926944", "4753814807728668592887997385900125890" ], "threshold": 0.9 }, "id": "CVE-2022-49788-367e842b", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c" }, "deprecated": false, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ccf7229b96fadc3a185d1391f814a604c7ef609", "signature_version": "v1", "digest": { "length": 862.0, "function_hash": "305409483525910010601394762053899174207" }, "id": "CVE-2022-49788-3b18bfeb", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d", "signature_version": "v1", "digest": { "length": 531.0, "function_hash": "63857422984950391237516136831564175256" }, "id": "CVE-2022-49788-3c36e6a7", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer_local" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7061dd1fef2dfb6458cd521aef27aa66f510d31", "signature_version": "v1", "digest": { "length": 862.0, "function_hash": "305409483525910010601394762053899174207" }, "id": "CVE-2022-49788-64d58cc5", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b0d06d9b10f5f43101bd6598b076c347f9295f", "signature_version": "v1", "digest": { "line_hashes": [ "209655890880633366552970355406167722262", "330698285898390997907438196163819624920", "316367586982842170453554547481226388991", "321601698541616732922221037046849824578", "281779678970173230314234052935964926944", "4753814807728668592887997385900125890" ], "threshold": 0.9 }, "id": "CVE-2022-49788-7f6fdf88", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c" }, "deprecated": false, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a275528025ae4bc7e2232866856dfebf84b2fad", "signature_version": "v1", "digest": { "length": 531.0, "function_hash": "63857422984950391237516136831564175256" }, "id": "CVE-2022-49788-7fc4f260", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer_local" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d", "signature_version": "v1", "digest": { "line_hashes": [ "209655890880633366552970355406167722262", "330698285898390997907438196163819624920", "316367586982842170453554547481226388991", "321601698541616732922221037046849824578", "281779678970173230314234052935964926944", "4753814807728668592887997385900125890" ], "threshold": 0.9 }, "id": "CVE-2022-49788-93bb8b2e", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c" }, "deprecated": false, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ccf7229b96fadc3a185d1391f814a604c7ef609", "signature_version": "v1", "digest": { "length": 531.0, "function_hash": "63857422984950391237516136831564175256" }, "id": "CVE-2022-49788-95272895", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer_local" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b0d06d9b10f5f43101bd6598b076c347f9295f", "signature_version": "v1", "digest": { "length": 862.0, "function_hash": "305409483525910010601394762053899174207" }, "id": "CVE-2022-49788-96b731ac", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a275528025ae4bc7e2232866856dfebf84b2fad", "signature_version": "v1", "digest": { "length": 862.0, "function_hash": "305409483525910010601394762053899174207" }, "id": "CVE-2022-49788-a09ffd71", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e2f33c598370bcf828bab4d667d1d38bcd3c57d", "signature_version": "v1", "digest": { "length": 862.0, "function_hash": "305409483525910010601394762053899174207" }, "id": "CVE-2022-49788-ade05e81", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62634b43d3c4e1bf62fd540196f7081bf0885c0a", "signature_version": "v1", "digest": { "length": 862.0, "function_hash": "305409483525910010601394762053899174207" }, "id": "CVE-2022-49788-b015880a", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f04586c2315cfd03d72ad0395705435e7ed07b1a", "signature_version": "v1", "digest": { "line_hashes": [ "209655890880633366552970355406167722262", "330698285898390997907438196163819624920", "316367586982842170453554547481226388991", "321601698541616732922221037046849824578", "281779678970173230314234052935964926944", "4753814807728668592887997385900125890" ], "threshold": 0.9 }, "id": "CVE-2022-49788-be24a2a8", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c" }, "deprecated": false, "signature_type": "Line" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f04586c2315cfd03d72ad0395705435e7ed07b1a", "signature_version": "v1", "digest": { "length": 862.0, "function_hash": "305409483525910010601394762053899174207" }, "id": "CVE-2022-49788-c7291a1c", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c50d77b928a33e5290aaa9fdc10e88254ff8c7", "signature_version": "v1", "digest": { "length": 862.0, "function_hash": "305409483525910010601394762053899174207" }, "id": "CVE-2022-49788-c9be5d9f", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62634b43d3c4e1bf62fd540196f7081bf0885c0a", "signature_version": "v1", "digest": { "length": 531.0, "function_hash": "63857422984950391237516136831564175256" }, "id": "CVE-2022-49788-ce73a67d", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer_local" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@76c50d77b928a33e5290aaa9fdc10e88254ff8c7", "signature_version": "v1", "digest": { "length": 531.0, "function_hash": "63857422984950391237516136831564175256" }, "id": "CVE-2022-49788-d2cc28f2", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer_local" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e5b0d06d9b10f5f43101bd6598b076c347f9295f", "signature_version": "v1", "digest": { "length": 531.0, "function_hash": "63857422984950391237516136831564175256" }, "id": "CVE-2022-49788-f51b7491", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer_local" }, "deprecated": false, "signature_type": "Function" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7061dd1fef2dfb6458cd521aef27aa66f510d31", "signature_version": "v1", "digest": { "length": 531.0, "function_hash": "63857422984950391237516136831564175256" }, "id": "CVE-2022-49788-fbdf5185", "target": { "file": "drivers/misc/vmw_vmci/vmci_queue_pair.c", "function": "qp_notify_peer_local" }, "deprecated": false, "signature_type": "Function" } ] }