Strix
26.1K

CVE-2022-50733

UnknownEPSS 0.24%

Last modified

CVE-2022-50733 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. EPSS estimates a 0.24% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check for valid image incurs an uninitialized dereference. Fix this by moving the check before reset label since this check only be valid if the data after bulk_in_buffer[HEADER] has concrete data. Note that this is found by KMSAN, so only kernel compilation is tested.

Metrics

EPSS Probability
0.24%

14.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 4244f72436ab77c3c29a6447af81734ab3925d85, < b3304a6df957cc89a0590cb505388d659bf3db4c; >= 4244f72436ab77c3c29a6447af81734ab3925d85, < 7dad42032f68718259590b0cc7654e9a95ff9762; >= 4244f72436ab77c3c29a6447af81734ab3925d85, < f589b667567fde4f81d6e6c40f42b9f2224690ea; >= 4244f72436ab77c3c29a6447af81734ab3925d85, < 1eae30c0113dde7522088231584d62415011a035; >= 4244f72436ab77c3c29a6447af81734ab3925d85, < b8bbae3236ab7dccc66c42bc3f7cdbcfc0786e54; >= 4244f72436ab77c3c29a6447af81734ab3925d85, < 20b8c456df584ebb2387dc23d40ebe4ff334417c; >= 4244f72436ab77c3c29a6447af81734ab3925d85, < 6163a5ae097bc78fa26c243fb384537e25610fd7; >= 4244f72436ab77c3c29a6447af81734ab3925d85, < adad163d1cff248a5df9f7cec50158e6ca89f33b; >= 4244f72436ab77c3c29a6447af81734ab3925d85, < bce2b0539933e485d22d6f6f076c0fcd6f185c4c
LinuxLinux2.6.13

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2022-50733?
In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check for valid image incurs an uninitialized dereference. Fix this by moving the check before reset label since this check only be valid if the data after bulk_in_buffer[HEADER] has concrete data. Note that this is found by KMSAN, so only kernel compilation is tested.
How severe is CVE-2022-50733?
Severity scoring for CVE-2022-50733 is pending analysis. The EPSS model estimates a 0.24% probability of exploitation in the next 30 days.
How do I fix CVE-2022-50733?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2022

View all 2022CVEs →

Are you affected by CVE-2022-50733?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST