CVE-2022-50709

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()

syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for

ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with

pkt_len = 0 but ath9k_hif_usb_rx_stream() uses

__dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that

pkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb

with uninitialized memory and ath9k_htc_rx_msg() is reading from

uninitialized memory.

Since bytes accessed by ath9k_htc_rx_msg() is not known until

ath9k_htc_rx_msg() is called, it would be difficult to check minimal valid

pkt_len at "if (pkt_len > 2 * MAX_RX_BUF_SIZE) {" line in

ath9k_hif_usb_rx_stream().

We have two choices. One is to workaround by adding __GFP_ZERO so that

ath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to let

ath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose

the latter.

Note that I'm

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References