CVE-2022-2308CWE-457

A flaw was found in vDPA with VDUSE backend

published September 1, 2022

CVSS
—
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

A flaw was found in vDPA with VDUSE backend. There are currently no checks in VDUSE kernel driver to ensure the size of the device config space is in line with the features advertised by the VDUSE userspace application. In case of a mismatch, Virtio drivers config read helpers do not initialize the memory indirectly passed to vduse_vdpa_get_config() returning uninitialized memory from the stack. This could cause undefined behavior or data leaks in Virtio drivers.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00233 · 13.3th percentile
Weakness
CWE-457 · Use of Uninitialized Variable
Published
2022-09-01T20:01Z
EPSS history
Timeline
  • 01 SEP 20:01Z
    A flaw was found in vDPA with VDUSE backend
    cvelistv5