Linux Kernel ath9k_htc Uninitialized Value Vulnerability

A vulnerability in the Linux kernel's ath9k_htc driver has been addressed, concerning uninitialized value bugs. These issues, reported by Syzbot, stem from missing field initializations. Specifically, in the 'htc_connect_service' function, the 'svc_meta_len' and 'pad' variables were not properly initialized. The 'htc_issue_send' function also failed to initialize the 'htc_frame_hdr::control' array. Although the firmware is expected to initialize it, the function has been updated to zero out the array, addressing the KMSAN (Kernel Memory Sanitizer) concerns.

Impact

Exploitation of this vulnerability could lead to a kernel information leak via the USB subsystem, caused by the uninitialized variables being sent over USB, as indicated by the KMSAN reports.