CVE-2022-50421: rpmsg: char: Avoid double destroy of default endpoint
In the Linux kernel, the following vulnerability has been resolved:
rpmsg: char: Avoid double destroy of default endpoint
The rpmsgdevremove() in rpmsgcore is the place for releasing this default endpoint.
So need to avoid destroying the default endpoint in rpmsgchrdeveptdevdestroy(), this should be the same as rpmsgeptdevrelease(). Otherwise there will be double destroy issue that ept->refcount report warning:
refcountt: underflow; use-after-free.
Call trace: refcountwarnsaturate+0xf8/0x150 virtiorpmsgdestroyept+0xd4/0xec rpmsgdevremove+0x60/0x70
The issue can be reproduced by stopping remoteproc before closing the /dev/rpmsgX.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50421?
CVE-2022-50421 has been rated as a moderate severity vulnerability due to its potential impact on system stability.
How do I fix CVE-2022-50421?
To fix CVE-2022-50421, update the Linux kernel to a version that is not affected, specifically 5.19.17 and later, or 6.0.3 and later.
What software is affected by CVE-2022-50421?
CVE-2022-50421 affects versions of the Linux Kernel between 5.18 and 5.19.17, and between 6.0 and 6.0.3.
What is the impact of CVE-2022-50421?
The impact of CVE-2022-50421 includes potential system crashes and unexpected behavior due to the improper handling of default endpoints.
Was CVE-2022-50421 publicly disclosed?
Yes, CVE-2022-50421 was publicly disclosed in the Linux kernel's stable release notes.