CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback()
In the Linux kernel, the following vulnerability has been resolved:
media: si470x: Fix use-after-free in si470xintincallback()
syzbot reported use-after-free in si470xintincallback() [1]. This indicates that urb->context, which contains struct si470xdevice object, is freed when si470xintincallback() is called.
The cause of this issue is that si470xintincallback() is called for freed urb.
si470xusbdriverprobe() calls si470xstartusb(), which then calls usbsubmiturb() and si470xstart(). If si470xstartusb() fails, si470xusbdriverprobe() doesn't kill urb, but it just frees struct si470xdevice object, as depicted below:
si470xusbdriverprobe() ... si470xstartusb() ... usbsubmiturb() retval = si470xstart() return retval if (retval < 0) free struct si470xdevice object, but don't kill urb
This patch fixes this issue by killing urb when si470xstartusb() fails and urb is submitted. If si470xstartusb() fails and urb is not submitted, i.e. submitting usb fails, it just frees struct si470xdevice object.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50542?
CVE-2022-50542 is classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2022-50542?
To fix CVE-2022-50542, update your Linux kernel to the latest stable version that includes the patch for this vulnerability.
What is the impact of CVE-2022-50542?
The impact of CVE-2022-50542 includes potential exploitation that could lead to a use-after-free condition in the si470x driver.
Which versions of Linux are affected by CVE-2022-50542?
CVE-2022-50542 affects multiple versions of the Linux kernel that include the vulnerable si470x driver prior to the fix.
Is CVE-2022-50542 a remote or local vulnerability?
CVE-2022-50542 is considered a local vulnerability, requiring local access to exploit the use-after-free condition.