Log in Start free

Vulnerability · Published Sep 1, 2022 · Assigned by redhat

CVE-2022-2308

Medium 6.5

In plain English

A medium-severity security flaw in Linux kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.2%top 85.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.2-1DEBIAN-CVE-2022-2308
Debian:13linux6.0.2-1DEBIAN-CVE-2022-2308
Debian:14linux6.0.2-1DEBIAN-CVE-2022-2308
Ubuntu:22.04:LTSlinux5.15.0-57.63UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-aws5.15.0-1027.31UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-azure5.15.0-1030.37UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1030.37.1UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-gcp5.15.0-1026.33UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-gke5.15.0-1024.29UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1012.16UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-ibm5.15.0-1022.25UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1023.28UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-kvm5.15.0-1025.30UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-57.63UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1015.15UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-oracle5.15.0-1026.32UBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-raspi5.15.0-1022.24UBUNTU-CVE-2022-2308
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-2308
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-2308

Affected products (as reported)

VendorProductVersions
n/a Linux kernel uknown

Weakness: CWE-457

References