CVE-2022-50531

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix an information leak in tipc_topsrv_kern_subscr

Use a 8-byte write to initialize sub.usr_handle in

tipc_topsrv_kern_subscr(), otherwise four bytes remain uninitialized

when issuing setsockopt(..., SOL_TIPC, ...).

This resulted in an infoleak reported by KMSAN when the packet was

received:

=====================================================

BUG: KMSAN: kernel-infoleak in copyout+0xbc/0x100 lib/iov_iter.c:169

instrument_copy_to_user ./include/linux/instrumented.h:121

copyout+0xbc/0x100 lib/iov_iter.c:169

_copy_to_iter+0x5c0/0x20a0 lib/iov_iter.c:527

copy_to_iter ./include/linux/uio.h:176

simple_copy_to_iter+0x64/0xa0 net/core/datagram.c:513

__skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419

skb_copy_datagram_iter+0x58/0x200 net/core/datagram.c:527

skb_copy_datagram_msg ./include/linux/skbuff.h:3903

packet_recvmsg+0x521/0x1e70 net/packet/af_packet.c:3469

____sys_recvmsg

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References