Skip to content

kernel CVE-2022-2308

Moderate
rpkelly published GHSA-63fj-95gm-6vp7 Jan 27, 2023

Package

kernel-5.15 (bottlerocket)

Affected versions

< 1.12.0

Patched versions

1.12.0

Description

A flaw was found in the Linux kernel in vDPA with VDUSE backend. There were no checks in VDUSE kernel driver to ensure the size of the device config space was in line with the features advertised by the VDUSE userspace application. In case of a mismatch, virtio drivers config read helpers did not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. Such memory was not directly propagated to userspace, although under some circumstances it could be printed in the kernel logs.

Severity

Moderate

CVE ID

CVE-2022-2308

Weaknesses

No CWEs