In the Linux kernel, the following vulnerability has been resolved:
ASoC: rt5645: Fix errorenous cleanup order
There is a logic error when removing rt5645 device as the function rt5645i2cremove() first cancel the &rt5645->jackdetectwork and delete the &rt5645->btnchecktimer latter. However, since the timer handler rt5645btncheckcallback() will re-queue the jackdetect_work, this cleanup order is buggy.
That is, once the deltimersync in rt5645i2cremove is concurrently run with the rt5645btncheckcallback, the canceled jackdetect_work will be rescheduled again, leading to possible use-after-free.
This patch fix the issue by placing the deltimersync function before the canceldelayedwork_sync.
[
{
"id": "CVE-2022-49493-1b275011",
"target": {
"function": "rt5645_i2c_remove",
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"length": 323.0,
"function_hash": "35215054360142048528670298982364217611"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe7554da62cb489712a54de69ef5665c250e564",
"signature_type": "Function"
},
{
"id": "CVE-2022-49493-29399fd2",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"320716168482682492967752849073449263971",
"40616711771614894243303300673945429469",
"313486670481177246096902761695285963544"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a5a3dfd9f172dcb115072f0aea5e27d3083c20e",
"signature_type": "Line"
},
{
"id": "CVE-2022-49493-2c9f3667",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"320716168482682492967752849073449263971",
"40616711771614894243303300673945429469",
"313486670481177246096902761695285963544"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@453f0920ffc1a28e28ddb9c3cd5562472b2895b0",
"signature_type": "Line"
},
{
"id": "CVE-2022-49493-4bbb7b66",
"target": {
"function": "rt5645_i2c_remove",
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"length": 323.0,
"function_hash": "35215054360142048528670298982364217611"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2def44d3aec59e38d2701c568d65540783f90f2f",
"signature_type": "Function"
},
{
"id": "CVE-2022-49493-5731a51b",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"320716168482682492967752849073449263971",
"40616711771614894243303300673945429469",
"313486670481177246096902761695285963544"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@061a6159cea583f1155f67d1915917a6b9282662",
"signature_type": "Line"
},
{
"id": "CVE-2022-49493-5c8c1c0b",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"320716168482682492967752849073449263971",
"40616711771614894243303300673945429469",
"313486670481177246096902761695285963544"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@abe7554da62cb489712a54de69ef5665c250e564",
"signature_type": "Line"
},
{
"id": "CVE-2022-49493-5d333c24",
"target": {
"function": "rt5645_i2c_remove",
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"length": 323.0,
"function_hash": "35215054360142048528670298982364217611"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88c09e4812d72c3153afc8e5a45ecac2d0eae3ff",
"signature_type": "Function"
},
{
"id": "CVE-2022-49493-6316cf64",
"target": {
"function": "rt5645_i2c_remove",
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"length": 323.0,
"function_hash": "35215054360142048528670298982364217611"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0941150100173d4eaf3fe08ff4b16740e7c3026f",
"signature_type": "Function"
},
{
"id": "CVE-2022-49493-76ba4d49",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"223092256261893372998024397799612520219",
"89239976173485451295819670614896440425",
"287016778049230451947300916681562582523"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@236d29c5857f02e0a53fdf15d3dce1536c4322ce",
"signature_type": "Line"
},
{
"id": "CVE-2022-49493-81d63120",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"320716168482682492967752849073449263971",
"40616711771614894243303300673945429469",
"313486670481177246096902761695285963544"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2def44d3aec59e38d2701c568d65540783f90f2f",
"signature_type": "Line"
},
{
"id": "CVE-2022-49493-ba3f6377",
"target": {
"function": "rt5645_i2c_remove",
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"length": 323.0,
"function_hash": "35215054360142048528670298982364217611"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@453f0920ffc1a28e28ddb9c3cd5562472b2895b0",
"signature_type": "Function"
},
{
"id": "CVE-2022-49493-c2ad28f9",
"target": {
"function": "rt5645_i2c_remove",
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"length": 353.0,
"function_hash": "31542541024513162816295076798083178354"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@236d29c5857f02e0a53fdf15d3dce1536c4322ce",
"signature_type": "Function"
},
{
"id": "CVE-2022-49493-d516d002",
"target": {
"function": "rt5645_i2c_remove",
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"length": 323.0,
"function_hash": "35215054360142048528670298982364217611"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1a5a3dfd9f172dcb115072f0aea5e27d3083c20e",
"signature_type": "Function"
},
{
"id": "CVE-2022-49493-d6838132",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"320716168482682492967752849073449263971",
"40616711771614894243303300673945429469",
"313486670481177246096902761695285963544"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@88c09e4812d72c3153afc8e5a45ecac2d0eae3ff",
"signature_type": "Line"
},
{
"id": "CVE-2022-49493-e27e1af5",
"target": {
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"314912957237835491086034877028711253667",
"228989190716421217615266498701318160267",
"219239485468551647948095087856440129927",
"320716168482682492967752849073449263971",
"40616711771614894243303300673945429469",
"313486670481177246096902761695285963544"
],
"threshold": 0.9
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0941150100173d4eaf3fe08ff4b16740e7c3026f",
"signature_type": "Line"
},
{
"id": "CVE-2022-49493-e73b6b40",
"target": {
"function": "rt5645_i2c_remove",
"file": "sound/soc/codecs/rt5645.c"
},
"signature_version": "v1",
"digest": {
"length": 323.0,
"function_hash": "35215054360142048528670298982364217611"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@061a6159cea583f1155f67d1915917a6b9282662",
"signature_type": "Function"
}
]