#VU104771 Use of uninitialized resource in Linux kernel - CVE-2022-49301

Vulnerability identifier: #VU104771

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49301

CWE-ID: CWE-908

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to use of uninitialized resource within the usb_read8(), usb_read16() and usb_read32() functions in drivers/staging/rtl8712/usb_ops.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/33ef21d55418ab6a62a63fd550b2dbe297433372
https://git.kernel.org/stable/c/58762f1c63c75cbe1dc393eed3c9cf8e38310ca1
https://git.kernel.org/stable/c/95b0f54f8a898072a2810c05fab34d971f23a612
https://git.kernel.org/stable/c/d1b57669732d09da7e13ef86d058dab0cd57f6e0
https://git.kernel.org/stable/c/d7ed3c85da0b230bcdf5329acfe012ed093f3daa
https://git.kernel.org/stable/c/de075af8c404f7d59ed34df230aedd9f645fb846

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.