CVE-2022-50709

Vulnerability

CVE-2022-50709 is a flaw in the Linux kernel's ath9k WiFi driver, specifically in the ath9k_htc_rx_msg() function. The root cause is that the driver does not validate the packet length (pkt_len) received from a USB endpoint before using it to allocate a socket buffer via __dev_skb_alloc(). An attacker can send a crafted USB request (e.g., via ioctl(USB_RAW_IOCTL_EP_WRITE)) with pkt_len = 0, causing the driver to allocate an skb of insufficient size and then read from uninitialized kernel memory [1][2].

Exploitation

Exploitation requires physical access or the ability to send malicious USB control transfers to a device using the ath9k_htc driver. No authentication is needed beyond the ability to interact with the USB device. The attacker triggers the vulnerable code path by writing a zero-length packet to the USB endpoint, which the driver's ath9k_hif_usb_rx_stream() function processes without checking the validity of pkt_len [1][2].

Impact

A successful exploit could allow an attacker to read uninitialized kernel memory, potentially leaking sensitive information such sensitive information as cryptographic keys, passwords, or other kernel data. The impact is limited to information disclosure; the vulnerability does not directly enable code execution or privilege escalation [1][2].

Mitigation

The Linux kernel community has addressed this issue by adding a validation check in ath9k_htc_rx_msg() to verify `pkt_len before accessing the skb data. The fix was backported to multiple stable kernel branches. Users should apply the latest kernel updates from their distribution to remediate the vulnerability [1][2][3].