CVE-2022-0494: Linux Kernel Information Disclosure Flaw

CVE-2022-0494 Overview

CVE-2022-0494 is a kernel information leak flaw in the scsi_ioctl function located in drivers/scsi/scsi_ioctl.c within the Linux kernel. The vulnerability allows a local attacker holding CAP_SYS_ADMIN or CAP_SYS_RAWIO capabilities to read uninitialized kernel memory. Successful exploitation breaks confidentiality boundaries between user space and kernel space. Affected systems include the Linux kernel through release candidates of 5.17 and multiple Debian Linux versions (9, 10, 11). The flaw is tracked under [CWE-200] (Information Exposure) and [CWE-908] (Use of Uninitialized Resource).

Critical Impact
A local privileged user can extract sensitive kernel memory contents through SCSI ioctl operations, potentially exposing cryptographic material, addresses useful for bypassing KASLR, or other sensitive data in adjacent kernel allocations.

Affected Products

Linux Kernel (versions up to 5.17 release candidates rc1 through rc4)
Debian Linux 9.0, 10.0, and 11.0
Distributions shipping vulnerable kernel builds prior to the upstream fix

Discovery Timeline

2022-02-16 - Patch discussion posted to the Linux Kernel Mailing List
2022-03-25 - CVE-2022-0494 published to NVD
2022-05-10 - Debian Security Advisory DSA-5161 released
2022-05-31 - Debian Security Advisory DSA-5173 released
2022-07 - Debian LTS announcement published
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0494

Vulnerability Analysis

The flaw resides in the SCSI generic ioctl handling path in drivers/scsi/scsi_ioctl.c. When user space issues an SCSI ioctl command, the kernel allocates a buffer to stage data returned from the SCSI device. The vulnerable code path fails to fully initialize this buffer before copying its contents back to user space. As a result, residual data from previously freed kernel allocations may be exposed when the underlying device returns less data than expected.

The issue requires CAP_SYS_ADMIN or CAP_SYS_RAWIO, restricting direct exploitation to privileged local users. However, the leaked data can assist attackers chaining additional vulnerabilities by defeating Kernel Address Space Layout Randomization (KASLR) or exposing secrets resident in the slab allocator. Details are tracked in Red Hat Bug Report #2039448.

Root Cause

The root cause is improper initialization of a kernel buffer prior to its use in transferring data to user space, classified under [CWE-908]. The buffer is allocated with allocator functions that do not zero memory, and not every code path overwrites the full allocation before the copy_to_user operation. Stale slab contents therefore traverse the kernel/user boundary.

Attack Vector

Exploitation is local and requires elevated capabilities. An attacker with CAP_SYS_ADMIN or CAP_SYS_RAWIO opens a SCSI device node such as /dev/sg* or a block device, then issues crafted SG_IO or related ioctl requests. By manipulating request sizes and timing allocations alongside sensitive kernel objects, the attacker can increase the probability that the leaked buffer contains useful data such as keys, pointers, or credentials.

No verified public proof-of-concept code is available for CVE-2022-0494. Refer to the upstream kernel mailing list discussion for the technical patch details.

Detection Methods for CVE-2022-0494

Indicators of Compromise

Unexpected processes invoking SCSI ioctls (SG_IO, SCSI_IOCTL_SEND_COMMAND) on /dev/sg*, /dev/sd*, or /dev/sr* devices outside of normal storage management tooling
User-space binaries running with CAP_SYS_ADMIN or CAP_SYS_RAWIO performing repeated small-size ioctl reads against SCSI device nodes
Loaded kernel versions matching the vulnerable range reported in /proc/version and uname -a

Detection Strategies

Audit kernel build identifiers across the fleet and correlate against vendor advisories such as DSA-5161 and DSA-5173
Enable Linux audit rules (auditctl -a always,exit -F arch=b64 -S ioctl -F path=/dev/sg0) to log SCSI ioctl usage by non-storage processes
Hunt EDR telemetry for processes opening raw SCSI devices and immediately issuing ioctls, especially when launched from non-administrative directories

Monitoring Recommendations

Track which accounts and service identities have been granted CAP_SYS_ADMIN or CAP_SYS_RAWIO and review whether those privileges are still required
Forward kernel and audit logs to a centralized analytics pipeline to identify anomalous patterns of repeated short SCSI ioctl reads
Monitor package management events for kernel updates to confirm patched versions are deployed across the environment

How to Mitigate CVE-2022-0494

Immediate Actions Required

Apply distribution kernel updates that incorporate the upstream scsi_ioctl initialization fix; on Debian, install kernels referenced in DSA-5161 and DSA-5173
Reboot systems after kernel package installation so the patched kernel image is active
Inventory accounts holding CAP_SYS_ADMIN or CAP_SYS_RAWIO and revoke capabilities not strictly required for operations

Patch Information

The upstream fix initializes the response buffer in drivers/scsi/scsi_ioctl.c before returning it to user space. The change was merged ahead of the Linux 5.17 final release and backported across stable trees. Debian published fixed kernels via DSA-5161 and DSA-5173, and Red Hat tracks remediation in Bug #2039448. Long-term support guidance is provided in the Debian LTS announcement.

Workarounds

Restrict access to SCSI device nodes such as /dev/sg* using strict file permissions and group membership where workloads do not require raw SCSI access
Avoid granting CAP_SYS_RAWIO to containerized workloads; configure Linux capabilities and seccomp profiles to block the SCSI ioctl syscalls when not needed
Disable or unload unnecessary SCSI generic functionality on systems that do not require it, reducing the attack surface until kernels are patched

bash

# Verify kernel version and apply Debian updates
uname -r
sudo apt update && sudo apt install --only-upgrade linux-image-amd64
sudo reboot

# Restrict SCSI generic device access
sudo chmod 0600 /dev/sg*
sudo chown root:disk /dev/sg*

# Review processes with elevated capabilities
sudo getcap -r / 2>/dev/null | grep -E 'cap_sys_admin|cap_sys_rawio'