CVE Vulnerability

CVE-2022-2308

A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2 / Impact : 4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=2103900 Issue Tracking Third Party Advisory
Configurations

Configuration 1

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Information

Published : 2022-09-01 09:15

Updated : 2022-09-13 07:47

NVD link : CVE-2022-2308

Mitre link : CVE-2022-2308

Products Affected
No products.
CWE
CWE-908