CVE-2022-50709
Uninitialized Memory Read in Linux ath9k WiFi Driver
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's ath9k wireless driver involves reading uninitialized memory in the function ath9k_htc_rx_msg(). The issue arises because ath9k_hif_usb_rx_stream() can be called with a packet length (pkt_len) of zero, but it allocates memory assuming pkt_len is valid. This leads to allocation of memory that contains uninitialized data, which is then read by ath9k_htc_rx_msg(). The patch fixes this by validating pkt_len before accessing the memory to avoid reading uninitialized values.
How can this vulnerability impact me? :
This vulnerability can lead to the Linux kernel reading uninitialized memory, which may cause unpredictable behavior, potential information leakage, or system instability. Since uninitialized memory can contain sensitive data, this could be exploited to access unintended information or cause denial of service conditions.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is addressed by validating the pkt_len value before accessing memory in the ath9k_htc_rx_msg() function. Immediate mitigation steps include updating the Linux kernel to a version that contains the patch which adds this validation to prevent uninitialized memory reads. Alternatively, a workaround involves modifying the kernel code to add __GFP_ZERO flag during skb allocation to zero out memory, but the recommended approach is to apply the official patch or update.