CVE-2022-49374: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49374 is a vulnerability in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem that was discovered and reported by syzbot. The issue involves an uninitialized value access in the bearer name validation functionality, specifically in the string handling routines of the kernel's vsprintf implementation (NVD).

The vulnerability manifests in the tipc_enable_bearer function within net/tipc/bearer.c. The issue occurs during string handling operations, specifically in the string_nocheck function (lib/vsprintf.c:644) and related string operations. The bug was triggered in the call chain through tipc_nl_bearer_enable and __tipc_nl_bearer_enable functions when processing bearer names (Kernel Commit).

The vulnerability could lead to information disclosure through uninitialized memory access when processing TIPC bearer names. This could potentially expose sensitive kernel memory contents to unauthorized users (NVD).

The vulnerability can be triggered through the TIPC bearer name validation process. It requires local access to the system with the ability to interact with the TIPC subsystem (NVD).

The issue was fixed by implementing proper attribute length checking for TIPC bearer names and improving error handling in the bearer name validation process. The fix removes the use of 'illegal name' in printing messages and adds proper sanity checks for the TIPC_NLA_BEARER_NAME attribute length (Kernel Commit).