CVE-2022-49788

In the Linux kernel, the following vulnerability has been resolved:

misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()

`struct vmci_event_qp` allocated by qp_notify_peer() contains padding,
which may carry uninitialized data to the userspace, as observed by
KMSAN:

  BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121
   instrument_copy_to_user ./include/linux/instrumented.h:121
   _copy_to_user+0x5f/0xb0 lib/usercopy.c:33
   copy_to_user ./include/linux/uaccess.h:169
   vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431
   vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925
   vfs_ioctl fs/ioctl.c:51
  ...

  Uninit was stored to memory at:
   kmemdup+0x74/0xb0 mm/util.c:131
   dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271
   vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339
   qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479
   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750
   vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940
   vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488
   vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927
  ...

  Local variable ev created at:
   qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456
   qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662
   qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750

  Bytes 28-31 of 48 are uninitialized
  Memory access of size 48 starts at ffff888035155e00
  Data copied to user address 0000000020000100

Use memset() to prevent the infoleaks.

Also speculatively fix qp_notify_peer_local(), which may suffer from the
same problem.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
UNKNOWN
---
LinuxCNA
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
Debian logo
Debian Releases
Debian Product
Codename
linux
bullseye
5.10.223-1
fixed
bullseye (security)
5.10.234-1
fixed
bookworm
6.1.129-1
fixed
bookworm (security)
6.1.135-1
fixed
trixie
6.12.22-1
fixed
sid
6.12.25-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-allwinner-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-aws
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
linux-aws-5.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-aws-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-aws-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-aws-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-aws-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-aws-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-aws-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-aws-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-aws-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-aws-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-aws-hwe
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
xenial
needs-triage
linux-azure
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
trusty
needs-triage
linux-azure-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-azure-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-azure-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-azure-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-azure-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-azure-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-azure-edge
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-azure-fde
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
ignored
linux-azure-fde-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-azure-fde-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-fde-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-azure-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-azure-nvidia
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-bluefield
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-gcp
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
ignored
xenial
needs-triage
linux-gcp-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-gcp-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-gcp-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-gcp-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-gcp-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-gcp-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gcp-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-gcp-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-gcp-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-gcp-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-gcp-fips
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
linux-gke
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gke-4.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-gke-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gke-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-gkeop
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
ignored
linux-gkeop-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-gkeop-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-hwe
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
needs-triage
linux-hwe-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-hwe-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-hwe-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-hwe-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-hwe-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-hwe-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-hwe-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-hwe-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-hwe-edge
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
xenial
ignored
linux-ibm
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-ibm-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-ibm-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-intel-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-intel-iot-realtime
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-intel-iotg
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-intel-iotg-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-iot
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-kvm
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-lowlatency
plucky
dne
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
dne
linux-lowlatency-hwe-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-lowlatency-hwe-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-lowlatency-hwe-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-lowlatency-hwe-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-lowlatency-hwe-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-lowlatency-hwe-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-lts-xenial
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
trusty
needs-triage
linux-nvidia
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
dne
linux-nvidia-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-nvidia-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-nvidia-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-nvidia-lowlatency
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-nvidia-tegra
plucky
dne
oracular
dne
noble
needs-triage
jammy
needs-triage
focal
dne
linux-nvidia-tegra-igx
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-oem
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-oem-5.10
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.14
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-5.17
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oem-5.6
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oem-6.0
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oem-6.1
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oem-6.11
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-oem-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oem-6.8
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-oracle
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
linux-oracle-5.0
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-oracle-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.13
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-oracle-5.3
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
ignored
linux-oracle-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-oracle-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-oracle-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-oracle-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-raspi
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
needs-triage
linux-raspi-5.4
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
dne
bionic
needs-triage
linux-raspi-realtime
plucky
dne
oracular
dne
noble
needs-triage
jammy
dne
focal
dne
linux-raspi2
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-realtime
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
needs-triage
focal
dne
linux-riscv
plucky
needs-triage
oracular
needs-triage
noble
needs-triage
jammy
ignored
focal
ignored
linux-riscv-5.11
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-5.15
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
needs-triage
linux-riscv-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-riscv-5.8
plucky
dne
oracular
dne
noble
dne
jammy
dne
focal
ignored
linux-riscv-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-riscv-6.8
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
dne
linux-starfive-5.19
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-starfive-6.2
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-starfive-6.5
plucky
dne
oracular
dne
noble
dne
jammy
ignored
focal
dne
linux-xilinx-zynqmp
plucky
dne
oracular
dne
noble
dne
jammy
needs-triage
focal
needs-triage