CVE-2022-2308

What it actually does

Missing size validation in the VDUSE kernel driver allows a mismatch between advertised Virtio features and the actual device config space length, causing Virtio config-read helpers to return uninitialized stack memory via vduse_vdpa_get_config.

Why it matters to the business

Local users on affected Linux systems may obtain unintended kernel-stack contents, raising the risk of information leakage that could assist further privilege-escalation attempts in virtualized or containerized environments.

How an attack unfolds

An attacker with local access runs a userspace VDUSE application that advertises Virtio features while supplying a shorter config space; when a guest Virtio driver later reads configuration registers, the kernel helper copies uninitialized stack bytes back to the caller, disclosing residual memory.

How to fix it

Upgrade the Linux kernel to a version containing the VDUSE config-space size checks; apply all subsequent stable updates that address this class of Virtio/VDUSE validation issues.

How to confirm the fix worked

Confirm the running kernel contains the size-verification logic inside the VDUSE driver before vduse_vdpa_get_config; re-test device registration with deliberately mismatched feature and config lengths to ensure the call now fails safely.

Typical attack path

1. Obtain local shell or container access on a Linux host using VDUSE
2. Launch a malicious VDUSE userspace process that registers a device with mismatched config length
3. Trigger Virtio driver initialization or config-space queries from the guest or host side
4. Read the returned uninitialized memory to harvest stack contents

How to detect it

Review kernel logs for oops or warnings originating from virtio config helpers when VDUSE devices are present; inspect audit trails for unexpected VDUSE device registrations by non-root processes.

What your security team should do

• Prioritize kernel updates on all systems exposing VDUSE or vDPA devices
• Restrict untrusted local code execution on hosts that rely on VDUSE backends
• Audit container or VM configurations that enable VDUSE passthrough
• Monitor upstream kernel changelogs for additional Virtio config-handling fixes