Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2022-49235ath9k_htc: fix uninit value bugs

Description

In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initialized. Based on code it looks like in current skb there is no service data, so simply initialize svc_meta_len to 0. htc_issue_send() does not initialize htc_frame_hdr::control array. Based on firmware code, it will initialize it by itself, so simply zero whole array to make KMSAN happy Fail logs: BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 4-7 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00 BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 ... Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 kmalloc_reserve net/core/skbuff.c:354 [inline] __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 alloc_skb include/linux/skbuff.h:1126 [inline] htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 ... Bytes 16-17 of 18 are uninitialized Memory access of size 18 starts at ffff888027377e00

Timeline

  1. ID reserved

    By Linux

  2. Published

  3. · 15 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-49235, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1Medium5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Modified3.1Medium5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
0.28% · top 80% of all CVEs (15 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Affected products

  • Linux · Linux

    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < 5c2a6a8daa17a3f65b38b9a5574bb362c13fa1d9
    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < e352acdd378e9263cc4c6018e588f2dac7161d07
    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < ee4222052a76559c20e821bc3519cefb58b6d3e9
    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < 4d244b731188e0b63fc40a9d2dec72e9181fb37c
    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < 11f11ac281f0c0b363d2940204f28bae0422ed71
    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < 0b700f7d06492de34964b6f414120043364f8191
    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < 7da6169b6ebb75816b57be3beb829afa74f3b4b6
    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < 5abf2b761b998063f5e2bae93fd4ab10e2a80f10
    • affected fb9987d0f748c983bb795a86f47522313f701a08 – < d1e0df1c57bd30871dd1c855742a7c346dbca853

  • Linux · Linux

    • affected 2.6.35
    • unaffected < 2.6.35
    • unaffected 4.9.311 – ≤ 4.9.*
    • unaffected 4.14.276 – ≤ 4.14.*
    • unaffected 4.19.238 – ≤ 4.19.*
    • unaffected 5.4.189 – ≤ 5.4.*
    • unaffected 5.10.110 – ≤ 5.10.*
    • unaffected 5.15.33 – ≤ 5.15.*
    • unaffected 5.16.19 – ≤ 5.16.*
    • unaffected 5.17.2 – ≤ 5.17.*
    • unaffected 5.18 – ≤ *

References

References9

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2022-49235 badge
[![CVE-2022-49235](https://cveledger.app/badge/CVE-2022-49235.svg)](https://cveledger.app/cve/CVE-2022-49235)

Record last updated .