CVE-2022-2308: linux linux_kernel Use of Uninitialized Variable

Vulnerability summary

CVE-2022-2308 is a medium (CVSS 6.5) Use of Uninitialized Variable vulnerability in linux linux_kernel. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 14.2% of scored vulnerabilities.

Timeline

1. 01-09-2022
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.

• CWE-457Use of Uninitialized VariableThe code uses a variable that has not been initialized, leading to unpredictable or unintended results.
• CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.