{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2022-49788", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-49788", "idYear": 2022, "status": "PUBLISHED", "publishedAt": "2025-05-01T14:09:20.506Z", "updatedAt": "2026-05-11T19:06:47.654Z", "importedAt": "2026-10-24T01:56:49.724Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram()\n\n`struct vmci_event_qp` allocated by qp_notify_peer() contains padding,\nwhich may carry uninitialized data to the userspace, as observed by\nKMSAN:\n\n BUG: KMSAN: kernel-infoleak in instrument_copy_to_user ./include/linux/instrumented.h:121\n instrument_copy_to_user ./include/linux/instrumented.h:121\n _copy_to_user+0x5f/0xb0 lib/usercopy.c:33\n copy_to_user ./include/linux/uaccess.h:169\n vmci_host_do_receive_datagram drivers/misc/vmw_vmci/vmci_host.c:431\n vmci_host_unlocked_ioctl+0x33d/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:925\n vfs_ioctl fs/ioctl.c:51\n ...\n\n Uninit was stored to memory at:\n kmemdup+0x74/0xb0 mm/util.c:131\n dg_dispatch_as_host drivers/misc/vmw_vmci/vmci_datagram.c:271\n vmci_datagram_dispatch+0x4f8/0xfc0 drivers/misc/vmw_vmci/vmci_datagram.c:339\n qp_notify_peer+0x19a/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1479\n qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662\n qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750\n vmci_qp_broker_alloc+0x96/0xd0 drivers/misc/vmw_vmci/vmci_queue_pair.c:1940\n vmci_host_do_alloc_queuepair drivers/misc/vmw_vmci/vmci_host.c:488\n vmci_host_unlocked_ioctl+0x24fd/0x43d0 drivers/misc/vmw_vmci/vmci_host.c:927\n ...\n\n Local variable ev created at:\n qp_notify_peer+0x54/0x290 drivers/misc/vmw_vmci/vmci_queue_pair.c:1456\n qp_broker_attach drivers/misc/vmw_vmci/vmci_queue_pair.c:1662\n qp_broker_alloc+0x2977/0x2f30 drivers/misc/vmw_vmci/vmci_queue_pair.c:1750\n\n Bytes 28-31 of 48 are uninitialized\n Memory access of size 48 starts at ffff888035155e00\n Data copied to user address 0000000020000100\n\nUse memset() to prevent the infoleaks.\n\nAlso speculatively fix qp_notify_peer_local(), which may suffer from the\nsame problem.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "06164d2b72aa752ce4633184b3e0d97601017135", "status": "affected", "versionType": "git", "lessThan": "7ccf7229b96fadc3a185d1391f814a604c7ef609" }, { "version": "06164d2b72aa752ce4633184b3e0d97601017135", "status": "affected", "versionType": "git", "lessThan": "f04586c2315cfd03d72ad0395705435e7ed07b1a" }, { "version": "06164d2b72aa752ce4633184b3e0d97601017135", "status": "affected", "versionType": "git", "lessThan": "5a275528025ae4bc7e2232866856dfebf84b2fad" }, { "version": "06164d2b72aa752ce4633184b3e0d97601017135", "status": "affected", "versionType": "git", "lessThan": "e7061dd1fef2dfb6458cd521aef27aa66f510d31" }, { "version": "06164d2b72aa752ce4633184b3e0d97601017135", "status": "affected", "versionType": "git", "lessThan": "62634b43d3c4e1bf62fd540196f7081bf0885c0a" }, { "version": "06164d2b72aa752ce4633184b3e0d97601017135", "status": "affected", "versionType": "git", "lessThan": "8e2f33c598370bcf828bab4d667d1d38bcd3c57d" }, { "version": "06164d2b72aa752ce4633184b3e0d97601017135", "status": "affected", "versionType": "git", "lessThan": "76c50d77b928a33e5290aaa9fdc10e88254ff8c7" }, { "version": "06164d2b72aa752ce4633184b3e0d97601017135", "status": "affected", "versionType": "git", "lessThan": "e5b0d06d9b10f5f43101bd6598b076c347f9295f" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "3.9", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "3.9" }, { "version": "4.9.334", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.9.*" }, { "version": "4.14.300", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.14.*" }, { "version": "4.19.267", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "4.19.*" }, { "version": "5.4.225", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.4.*" }, { "version": "5.10.156", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.80", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.0.10", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.0.*" }, { "version": "6.1", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }