CVE-2022-50229: ALSA: bcd2000: Fix a UAF bug on the error path of probing
In the Linux kernel, the following vulnerability has been resolved:
ALSA: bcd2000: Fix a UAF bug on the error path of probing
When the driver fails in sndcardregister() at probe time, it will free the 'bcd2k->midiouturb' before killing it, which may cause a UAF bug.
The following log can reveal it:
[ 50.727020] BUG: KASAN: use-after-free in bcd2000inputcomplete+0x1f1/0x2e0 [sndbcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000inputcomplete+0x1f1/0x2e0 [sndbcd2000]
Fix this by adding usbkillurb() before usbfreeurb().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the UAF on the error path of probing in bcd2000 by adding usb_kill_urb() before usb_free_urb() for 'bcd2k->midi_out_urb' during the failure path of snd_card_register() at probe time.
Linux kernel driver: snd_bcd2000 (bcd2000) probe-time URB free order = Call usb_kill_urb() before usb_free_urb()
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50229?
CVE-2022-50229 is categorized with a medium severity level due to the potential for a Use-After-Free (UAF) vulnerability affecting the ALSA bcd2000 driver.
How do I fix CVE-2022-50229?
To fix CVE-2022-50229, ensure that you update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2022-50229?
CVE-2022-50229 affects specific versions of the Linux kernel that use the ALSA bcd2000 driver.
What type of vulnerability is CVE-2022-50229?
CVE-2022-50229 is a Use-After-Free (UAF) vulnerability that can occur during the error handling process in the ALSA bcd2000 driver.
When was CVE-2022-50229 disclosed?
CVE-2022-50229 was disclosed in 2022, following the identification of the UAF issue in the Linux kernel.