CVE-2022-40768

What it actually does

The stex_queuecommand_lck function in drivers/scsi/stex.c fails to initialize a command structure with memset before handling the PASSTHRU_CMD case, allowing uninitialized kernel memory to be returned to user space.

Why it matters to the business

Local users on affected Linux systems can read arbitrary kernel memory contents, which may expose credentials, encryption keys, or other sensitive internal data and increase the risk of further compromise.

How an attack unfolds

An attacker with local access on a system using the stex SCSI driver issues a crafted PASSTHRU_CMD request that triggers the missing initialization path, causing the driver to return uninitialized kernel memory back to the caller for inspection.

How to fix it

Upgrade the Linux kernel to a version later than 5.19.9 that includes the memset initialization fix for stex_queuecommand_lck; apply vendor-supplied kernel updates as soon as they become available.

How to confirm the fix worked

Confirm the presence of the memset call inside the PASSTHRU_CMD handling block in stex.c after applying updates; verify that the running kernel version is newer than 5.19.9 and test that passthrough commands no longer leak uninitialized memory.

Typical attack path

1. Obtain local user access on a vulnerable Linux host using the stex driver
2. Prepare and submit a PASSTHRU_CMD SCSI passthrough request with specific parameters
3. Read the returned buffer containing uninitialized kernel memory
4. Parse leaked data for sensitive artifacts such as credentials or pointers

How to detect it

Review system logs and audit records for unusual SCSI passthrough activity on hosts using the stex driver; inspect process execution and memory access patterns around stex-related operations for unexpected data returns.

What your security team should do

• Prioritize kernel updates on all systems exposing the stex SCSI driver
• Restrict local access and limit use of SCSI passthrough commands where possible
• Monitor for new kernel releases and schedule rapid deployment within standard change windows