Vulnerability in Linux Kernel
CVE-2022-2308
A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.
EPSS: 0.002 (13.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Linux Linux_kernel
- N/a Linux Kernel — versions uknown
Weakness classification (CWE)
References
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
Frequently asked questions
- What is CVE-2022-2308?
- CVE-2022-2308 is a medium-severity vulnerability in Linux Kernel, classified under CWE-457. CVSS score: 6.5/10. Published 2022-09-01.
- How severe is CVE-2022-2308?
- Medium severity. CVSS v3 base score is 6.5 out of 10.