cve-2022-48822
Vulnerability from cvelistv5
Published
2024-07-16 11:44
Modified
2024-12-19 08:08
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: f_fs: Fix use-after-free for epfile Consider a case where ffs_func_eps_disable is called from ffs_func_disable as part of composition switch and at the same time ffs_epfile_release get called from userspace. ffs_epfile_release will free up the read buffer and call ffs_data_closed which in turn destroys ffs->epfiles and mark it as NULL. While this was happening the driver has already initialized the local epfile in ffs_func_eps_disable which is now freed and waiting to acquire the spinlock. Once spinlock is acquired the driver proceeds with the stale value of epfile and tries to free the already freed read buffer causing use-after-free. Following is the illustration of the race: CPU1 CPU2 ffs_func_eps_disable epfiles (local copy) ffs_epfile_release ffs_data_closed if (last file closed) ffs_data_reset ffs_data_clear ffs_epfiles_destroy spin_lock dereference epfiles Fix this races by taking epfiles local copy & assigning it under spinlock and if epfiles(local) is null then update it in ffs->epfiles then finally destroy it. Extending the scope further from the race, protecting the ep related structures, and concurrent accesses.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3cPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dcPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626ePatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2cPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3cPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dcPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626ePatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3Patch
Impacted products
Vendor Product Version
Linux Linux Version: a9e6f83c2df199187a5248f824f31b6787ae23ae
Version: a9e6f83c2df199187a5248f824f31b6787ae23ae
Version: a9e6f83c2df199187a5248f824f31b6787ae23ae
Version: a9e6f83c2df199187a5248f824f31b6787ae23ae
Version: a9e6f83c2df199187a5248f824f31b6787ae23ae
Version: a9e6f83c2df199187a5248f824f31b6787ae23ae
Version: a9e6f83c2df199187a5248f824f31b6787ae23ae
 Create a notification for this product.
   Linux Linux Version: 4.9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:01.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48822",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:57:56.394722Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:12.015Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "32048f4be071f9a6966744243f1786f45bb22dc2",
              "status": "affected",
              "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae",
              "versionType": "git"
            },
            {
              "lessThan": "cfe5f6fd335d882bcc829a1c8a7d462a455c626e",
              "status": "affected",
              "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae",
              "versionType": "git"
            },
            {
              "lessThan": "c9fc422c9a43e3d58d246334a71f3390401781dc",
              "status": "affected",
              "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae",
              "versionType": "git"
            },
            {
              "lessThan": "0042178a69eb77a979e36a50dcce9794a3140ef8",
              "status": "affected",
              "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae",
              "versionType": "git"
            },
            {
              "lessThan": "72a8aee863af099d4434314c4536d6c9a61dcf3c",
              "status": "affected",
              "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae",
              "versionType": "git"
            },
            {
              "lessThan": "3e078b18753669615301d946297bafd69294ad2c",
              "status": "affected",
              "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae",
              "versionType": "git"
            },
            {
              "lessThan": "ebe2b1add1055b903e2acd86b290a85297edc0b3",
              "status": "affected",
              "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/gadget/function/f_fs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.230",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: f_fs: Fix use-after-free for epfile\n\nConsider a case where ffs_func_eps_disable is called from\nffs_func_disable as part of composition switch and at the\nsame time ffs_epfile_release get called from userspace.\nffs_epfile_release will free up the read buffer and call\nffs_data_closed which in turn destroys ffs-\u003eepfiles and\nmark it as NULL. While this was happening the driver has\nalready initialized the local epfile in ffs_func_eps_disable\nwhich is now freed and waiting to acquire the spinlock. Once\nspinlock is acquired the driver proceeds with the stale value\nof epfile and tries to free the already freed read buffer\ncausing use-after-free.\n\nFollowing is the illustration of the race:\n\n      CPU1                                  CPU2\n\n   ffs_func_eps_disable\n   epfiles (local copy)\n\t\t\t\t\tffs_epfile_release\n\t\t\t\t\tffs_data_closed\n\t\t\t\t\tif (last file closed)\n\t\t\t\t\tffs_data_reset\n\t\t\t\t\tffs_data_clear\n\t\t\t\t\tffs_epfiles_destroy\nspin_lock\ndereference epfiles\n\nFix this races by taking epfiles local copy \u0026 assigning it under\nspinlock and if epfiles(local) is null then update it in ffs-\u003eepfiles\nthen finally destroy it.\nExtending the scope further from the race, protecting the ep related\nstructures, and concurrent accesses."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:08:23.887Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8"
        },
        {
          "url": "https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3"
        }
      ],
      "title": "usb: f_fs: Fix use-after-free for epfile",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48822",
    "datePublished": "2024-07-16T11:44:08.638Z",
    "dateReserved": "2024-07-16T11:38:08.902Z",
    "dateUpdated": "2024-12-19T08:08:23.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48822\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-16T12:15:06.073\",\"lastModified\":\"2024-11-21T07:34:09.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: f_fs: Fix use-after-free for epfile\\n\\nConsider a case where ffs_func_eps_disable is called from\\nffs_func_disable as part of composition switch and at the\\nsame time ffs_epfile_release get called from userspace.\\nffs_epfile_release will free up the read buffer and call\\nffs_data_closed which in turn destroys ffs-\u003eepfiles and\\nmark it as NULL. While this was happening the driver has\\nalready initialized the local epfile in ffs_func_eps_disable\\nwhich is now freed and waiting to acquire the spinlock. Once\\nspinlock is acquired the driver proceeds with the stale value\\nof epfile and tries to free the already freed read buffer\\ncausing use-after-free.\\n\\nFollowing is the illustration of the race:\\n\\n      CPU1                                  CPU2\\n\\n   ffs_func_eps_disable\\n   epfiles (local copy)\\n\\t\\t\\t\\t\\tffs_epfile_release\\n\\t\\t\\t\\t\\tffs_data_closed\\n\\t\\t\\t\\t\\tif (last file closed)\\n\\t\\t\\t\\t\\tffs_data_reset\\n\\t\\t\\t\\t\\tffs_data_clear\\n\\t\\t\\t\\t\\tffs_epfiles_destroy\\nspin_lock\\ndereference epfiles\\n\\nFix this races by taking epfiles local copy \u0026 assigning it under\\nspinlock and if epfiles(local) is null then update it in ffs-\u003eepfiles\\nthen finally destroy it.\\nExtending the scope further from the race, protecting the ep related\\nstructures, and concurrent accesses.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: usb: f_fs: corrige el use-after-free para epfile Considere un caso en el que se llama a ffs_func_eps_disable desde ffs_func_disable como parte del cambio de composici\u00f3n y al mismo tiempo se llama a ffs_epfile_release desde el espacio de usuario. ffs_epfile_release liberar\u00e1 el b\u00fafer de lectura y llamar\u00e1 a ffs_data_closed, que a su vez destruir\u00e1 ffs-\u0026gt;epfiles y lo marcar\u00e1 como NULL. Mientras esto suced\u00eda, el controlador ya inicializ\u00f3 el archivo ep local en ffs_func_eps_disable, que ahora est\u00e1 liberado y esperando adquirir el spinlock. Una vez adquirido el spinlock, el controlador contin\u00faa con el valor obsoleto de epfile e intenta liberar el b\u00fafer de lectura ya liberado, lo que provoca un use-after-free. La siguiente es la ilustraci\u00f3n de la ejecuci\u00f3n: CPU1 CPU2 ffs_func_eps_disable epfiles (copia local) ffs_epfile_release ffs_data_closed if (\u00faltimo archivo cerrado) ffs_data_reset ffs_data_clear ffs_epfiles_destroy spin_lock desreferenciar epfiles Arregle estas ejecuci\u00f3ns tomando la copia local de epfiles y asign\u00e1ndola bajo spinlock y si epfiles(local) es null luego actual\u00edcelo en ffs-\u0026gt;epfiles y finalmente destr\u00fayalo. Ampliar el alcance m\u00e1s all\u00e1 de la ejecuci\u00f3n, proteger las estructuras relacionadas con ep y los accesos concurrentes.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.9\",\"versionEndExcluding\":\"4.14.267\",\"matchCriteriaId\":\"55F57F74-D5B8-4F73-8F19-CA80ABA698E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.230\",\"matchCriteriaId\":\"62845903-4271-4AFA-B8B7-6517ED5BFEB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.180\",\"matchCriteriaId\":\"6808B38F-AD73-4D55-A158-6EF605E8EB66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.101\",\"matchCriteriaId\":\"A154171E-A3B9-42BE-9E97-C9B0EA43FC54\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.24\",\"matchCriteriaId\":\"866451F0-299E-416C-B0B8-AE6B33E62CCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.10\",\"matchCriteriaId\":\"679523BA-1392-404B-AB85-F5A5408B1ECC\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T15:25:01.599Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48822\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:57:56.394722Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:21.315Z\"}}], \"cna\": {\"title\": \"usb: f_fs: Fix use-after-free for epfile\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a9e6f83c2df1\", \"lessThan\": \"32048f4be071\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a9e6f83c2df1\", \"lessThan\": \"cfe5f6fd335d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a9e6f83c2df1\", \"lessThan\": \"c9fc422c9a43\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a9e6f83c2df1\", \"lessThan\": \"0042178a69eb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a9e6f83c2df1\", \"lessThan\": \"72a8aee863af\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a9e6f83c2df1\", \"lessThan\": \"3e078b187536\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a9e6f83c2df1\", \"lessThan\": \"ebe2b1add105\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/usb/gadget/function/f_fs.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.14.267\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.230\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.180\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.101\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.16.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.16.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/usb/gadget/function/f_fs.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2\"}, {\"url\": \"https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e\"}, {\"url\": \"https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc\"}, {\"url\": \"https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8\"}, {\"url\": \"https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c\"}, {\"url\": \"https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c\"}, {\"url\": \"https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: f_fs: Fix use-after-free for epfile\\n\\nConsider a case where ffs_func_eps_disable is called from\\nffs_func_disable as part of composition switch and at the\\nsame time ffs_epfile_release get called from userspace.\\nffs_epfile_release will free up the read buffer and call\\nffs_data_closed which in turn destroys ffs-\u003eepfiles and\\nmark it as NULL. While this was happening the driver has\\nalready initialized the local epfile in ffs_func_eps_disable\\nwhich is now freed and waiting to acquire the spinlock. Once\\nspinlock is acquired the driver proceeds with the stale value\\nof epfile and tries to free the already freed read buffer\\ncausing use-after-free.\\n\\nFollowing is the illustration of the race:\\n\\n      CPU1                                  CPU2\\n\\n   ffs_func_eps_disable\\n   epfiles (local copy)\\n\\t\\t\\t\\t\\tffs_epfile_release\\n\\t\\t\\t\\t\\tffs_data_closed\\n\\t\\t\\t\\t\\tif (last file closed)\\n\\t\\t\\t\\t\\tffs_data_reset\\n\\t\\t\\t\\t\\tffs_data_clear\\n\\t\\t\\t\\t\\tffs_epfiles_destroy\\nspin_lock\\ndereference epfiles\\n\\nFix this races by taking epfiles local copy \u0026 assigning it under\\nspinlock and if epfiles(local) is null then update it in ffs-\u003eepfiles\\nthen finally destroy it.\\nExtending the scope further from the race, protecting the ep related\\nstructures, and concurrent accesses.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-04T12:17:15.498Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48822\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-04T12:17:15.498Z\", \"dateReserved\": \"2024-07-16T11:38:08.902Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-16T11:44:08.638Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.