In the Linux kernel, the following vulnerability has been resolved:
can: gsusb: gsusb_open/close(): fix memory leak
The gsusb driver appears to suffer from a malady common to many USB CAN adapter drivers in that it performs usballoccoherent() to allocate a number of USB request blocks (URBs) for RX, and then later relies on usbkillanchoredurbs() to free them, but this doesn't actually free them. As a result, this may be leaking DMA memory that's been used by the driver.
This commit is an adaptation of the techniques found in the esdusb2 driver where a similar design pattern led to a memory leak. It explicitly frees the RX URBs and their DMA memory via a call to usbfreecoherent(). Since the RX URBs were allocated in the gscanopen(), we remove them in gscanclose() rather than in the disconnect function as was done in esdusb2.
For more information, see the 928150fad41b ("can: esd_usb2: fix memory leak").
[
{
"id": "CVE-2022-49661-06b7797c",
"target": {
"function": "gs_can_close",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 605.0,
"function_hash": "247329164389025486096487524909322174245"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1d806bc29ff7ffe0e2a023583c8720ed96cb0b0"
},
{
"id": "CVE-2022-49661-1010c95f",
"target": {
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"162879828481458872975343838682783411164",
"326607816410144831536826466868255423709",
"75866146667384446868346924038242380552",
"217082694244448370580004413988812664520",
"192409016323580538764170847633063667014",
"47840372006190230727437069102677320181",
"267689069499941079450322516490884324764",
"148355759827089174976858018395346535881",
"72736251648389239549728144861269970848",
"180936814638189628702572781754432113351",
"162907374482148669640969673661164409344",
"254873531028362007640257671778338644288",
"37225637192167791246940909815404519656",
"172150087082339138232809099569026640445",
"60626851908108524494029005605851072865",
"131981932534430718235790722986976300445",
"50108084131301767556153565183425655764",
"52387072951618511809159250940391156521",
"300597919904524006162282907692709035850",
"5172343128725440298529440812313954334",
"283048659800826084154135600045255896551",
"265367497138542602315995536633235393979",
"48901281957595069365906037347759827221",
"18842293918642740792871011493979732941",
"105185971326798362534791594600596272982",
"151027756189007905452583905215971355750",
"131388513089890240379140616369012750579",
"129432374420130015769964029772496778637",
"181617239157297510335893778047412704825",
"323254418867832800671162357419612643179"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@339fa9f80d3b94177a7a459c6d115d3b56007d5a"
},
{
"id": "CVE-2022-49661-11dcbd2c",
"target": {
"function": "gs_can_close",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 599.0,
"function_hash": "271567806869674055663514468402295610451"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bda24ef95c0311ab93bda00db40486acf30bd0a"
},
{
"id": "CVE-2022-49661-14f55ed8",
"target": {
"function": "gs_can_open",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 2041.0,
"function_hash": "753760531083675542801068591300218770"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e60230bc64355c80abe993d1719fdb318094e20"
},
{
"id": "CVE-2022-49661-2cc45a2a",
"target": {
"function": "gs_can_close",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 605.0,
"function_hash": "247329164389025486096487524909322174245"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@339fa9f80d3b94177a7a459c6d115d3b56007d5a"
},
{
"id": "CVE-2022-49661-2d7db110",
"target": {
"function": "gs_can_close",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 599.0,
"function_hash": "271567806869674055663514468402295610451"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91492638b054f4a359621ef216242be5973ed6b"
},
{
"id": "CVE-2022-49661-355a4dc0",
"target": {
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"162879828481458872975343838682783411164",
"326607816410144831536826466868255423709",
"75866146667384446868346924038242380552",
"217082694244448370580004413988812664520",
"192409016323580538764170847633063667014",
"47840372006190230727437069102677320181",
"267689069499941079450322516490884324764",
"148355759827089174976858018395346535881",
"65069467970019250075044462853615873177",
"100308464840279563408731664038181298265",
"162907374482148669640969673661164409344",
"254873531028362007640257671778338644288",
"37225637192167791246940909815404519656",
"172150087082339138232809099569026640445",
"60626851908108524494029005605851072865",
"281130079399126525958145755113729651388",
"106135354864254471562872722133753421628",
"183294805526793462137483969475670351762",
"300597919904524006162282907692709035850",
"5172343128725440298529440812313954334",
"283048659800826084154135600045255896551",
"265367497138542602315995536633235393979",
"48901281957595069365906037347759827221",
"18842293918642740792871011493979732941",
"105185971326798362534791594600596272982",
"151027756189007905452583905215971355750",
"131388513089890240379140616369012750579",
"129432374420130015769964029772496778637",
"181617239157297510335893778047412704825",
"87796319722482043985402708612156328944"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bda24ef95c0311ab93bda00db40486acf30bd0a"
},
{
"id": "CVE-2022-49661-38d5745b",
"target": {
"function": "gs_can_close",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 599.0,
"function_hash": "271567806869674055663514468402295610451"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f655b5e13fa4b27e915b6c209ac0da74fd75963"
},
{
"id": "CVE-2022-49661-3aaa5f3f",
"target": {
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"162879828481458872975343838682783411164",
"326607816410144831536826466868255423709",
"75866146667384446868346924038242380552",
"217082694244448370580004413988812664520",
"192409016323580538764170847633063667014",
"47840372006190230727437069102677320181",
"267689069499941079450322516490884324764",
"148355759827089174976858018395346535881",
"72736251648389239549728144861269970848",
"180936814638189628702572781754432113351",
"162907374482148669640969673661164409344",
"254873531028362007640257671778338644288",
"37225637192167791246940909815404519656",
"172150087082339138232809099569026640445",
"60626851908108524494029005605851072865",
"131981932534430718235790722986976300445",
"50108084131301767556153565183425655764",
"52387072951618511809159250940391156521",
"300597919904524006162282907692709035850",
"5172343128725440298529440812313954334",
"283048659800826084154135600045255896551",
"265367497138542602315995536633235393979",
"48901281957595069365906037347759827221",
"18842293918642740792871011493979732941",
"105185971326798362534791594600596272982",
"151027756189007905452583905215971355750",
"131388513089890240379140616369012750579",
"129432374420130015769964029772496778637",
"181617239157297510335893778047412704825",
"87796319722482043985402708612156328944"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91492638b054f4a359621ef216242be5973ed6b"
},
{
"id": "CVE-2022-49661-3ccac5ab",
"target": {
"function": "gs_can_close",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 599.0,
"function_hash": "271567806869674055663514468402295610451"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e60230bc64355c80abe993d1719fdb318094e20"
},
{
"id": "CVE-2022-49661-4b49b777",
"target": {
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"162879828481458872975343838682783411164",
"326607816410144831536826466868255423709",
"75866146667384446868346924038242380552",
"217082694244448370580004413988812664520",
"192409016323580538764170847633063667014",
"47840372006190230727437069102677320181",
"267689069499941079450322516490884324764",
"148355759827089174976858018395346535881",
"72736251648389239549728144861269970848",
"180936814638189628702572781754432113351",
"162907374482148669640969673661164409344",
"254873531028362007640257671778338644288",
"37225637192167791246940909815404519656",
"172150087082339138232809099569026640445",
"60626851908108524494029005605851072865",
"131981932534430718235790722986976300445",
"50108084131301767556153565183425655764",
"52387072951618511809159250940391156521",
"300597919904524006162282907692709035850",
"5172343128725440298529440812313954334",
"283048659800826084154135600045255896551",
"265367497138542602315995536633235393979",
"48901281957595069365906037347759827221",
"18842293918642740792871011493979732941",
"105185971326798362534791594600596272982",
"151027756189007905452583905215971355750",
"131388513089890240379140616369012750579",
"129432374420130015769964029772496778637",
"181617239157297510335893778047412704825",
"87796319722482043985402708612156328944"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f655b5e13fa4b27e915b6c209ac0da74fd75963"
},
{
"id": "CVE-2022-49661-4dd3f733",
"target": {
"function": "gs_can_open",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 2041.0,
"function_hash": "753760531083675542801068591300218770"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6f655b5e13fa4b27e915b6c209ac0da74fd75963"
},
{
"id": "CVE-2022-49661-5ae4b222",
"target": {
"function": "gs_can_close",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 599.0,
"function_hash": "271567806869674055663514468402295610451"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0b8e223998866b3e7b2895927d4e9689b0a80d8"
},
{
"id": "CVE-2022-49661-658b312f",
"target": {
"function": "gs_can_open",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 2041.0,
"function_hash": "753760531083675542801068591300218770"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@339fa9f80d3b94177a7a459c6d115d3b56007d5a"
},
{
"id": "CVE-2022-49661-7d55aa5a",
"target": {
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"162879828481458872975343838682783411164",
"326607816410144831536826466868255423709",
"75866146667384446868346924038242380552",
"217082694244448370580004413988812664520",
"192409016323580538764170847633063667014",
"47840372006190230727437069102677320181",
"267689069499941079450322516490884324764",
"148355759827089174976858018395346535881",
"65069467970019250075044462853615873177",
"100308464840279563408731664038181298265",
"162907374482148669640969673661164409344",
"254873531028362007640257671778338644288",
"37225637192167791246940909815404519656",
"172150087082339138232809099569026640445",
"60626851908108524494029005605851072865",
"281130079399126525958145755113729651388",
"106135354864254471562872722133753421628",
"183294805526793462137483969475670351762",
"300597919904524006162282907692709035850",
"5172343128725440298529440812313954334",
"283048659800826084154135600045255896551",
"265367497138542602315995536633235393979",
"48901281957595069365906037347759827221",
"18842293918642740792871011493979732941",
"105185971326798362534791594600596272982",
"151027756189007905452583905215971355750",
"131388513089890240379140616369012750579",
"129432374420130015769964029772496778637",
"181617239157297510335893778047412704825",
"87796319722482043985402708612156328944"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffb6cc6601ec7c8fa963dcf76025df4a02f2cf5c"
},
{
"id": "CVE-2022-49661-97b3065b",
"target": {
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"162879828481458872975343838682783411164",
"326607816410144831536826466868255423709",
"75866146667384446868346924038242380552",
"217082694244448370580004413988812664520",
"192409016323580538764170847633063667014",
"47840372006190230727437069102677320181",
"267689069499941079450322516490884324764",
"148355759827089174976858018395346535881",
"72736251648389239549728144861269970848",
"180936814638189628702572781754432113351",
"162907374482148669640969673661164409344",
"254873531028362007640257671778338644288",
"37225637192167791246940909815404519656",
"172150087082339138232809099569026640445",
"60626851908108524494029005605851072865",
"131981932534430718235790722986976300445",
"50108084131301767556153565183425655764",
"52387072951618511809159250940391156521",
"300597919904524006162282907692709035850",
"5172343128725440298529440812313954334",
"283048659800826084154135600045255896551",
"265367497138542602315995536633235393979",
"48901281957595069365906037347759827221",
"18842293918642740792871011493979732941",
"105185971326798362534791594600596272982",
"151027756189007905452583905215971355750",
"131388513089890240379140616369012750579",
"129432374420130015769964029772496778637",
"181617239157297510335893778047412704825",
"323254418867832800671162357419612643179"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1d806bc29ff7ffe0e2a023583c8720ed96cb0b0"
},
{
"id": "CVE-2022-49661-a838774a",
"target": {
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"162879828481458872975343838682783411164",
"326607816410144831536826466868255423709",
"75866146667384446868346924038242380552",
"217082694244448370580004413988812664520",
"192409016323580538764170847633063667014",
"47840372006190230727437069102677320181",
"267689069499941079450322516490884324764",
"148355759827089174976858018395346535881",
"72736251648389239549728144861269970848",
"180936814638189628702572781754432113351",
"162907374482148669640969673661164409344",
"254873531028362007640257671778338644288",
"37225637192167791246940909815404519656",
"172150087082339138232809099569026640445",
"60626851908108524494029005605851072865",
"131981932534430718235790722986976300445",
"50108084131301767556153565183425655764",
"52387072951618511809159250940391156521",
"300597919904524006162282907692709035850",
"5172343128725440298529440812313954334",
"283048659800826084154135600045255896551",
"265367497138542602315995536633235393979",
"48901281957595069365906037347759827221",
"18842293918642740792871011493979732941",
"105185971326798362534791594600596272982",
"151027756189007905452583905215971355750",
"131388513089890240379140616369012750579",
"129432374420130015769964029772496778637",
"181617239157297510335893778047412704825",
"87796319722482043985402708612156328944"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0b8e223998866b3e7b2895927d4e9689b0a80d8"
},
{
"id": "CVE-2022-49661-a9bb9ec9",
"target": {
"function": "gs_can_open",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 2041.0,
"function_hash": "753760531083675542801068591300218770"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d91492638b054f4a359621ef216242be5973ed6b"
},
{
"id": "CVE-2022-49661-b4162a2d",
"target": {
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"162879828481458872975343838682783411164",
"326607816410144831536826466868255423709",
"75866146667384446868346924038242380552",
"217082694244448370580004413988812664520",
"192409016323580538764170847633063667014",
"47840372006190230727437069102677320181",
"267689069499941079450322516490884324764",
"148355759827089174976858018395346535881",
"72736251648389239549728144861269970848",
"180936814638189628702572781754432113351",
"162907374482148669640969673661164409344",
"254873531028362007640257671778338644288",
"37225637192167791246940909815404519656",
"172150087082339138232809099569026640445",
"60626851908108524494029005605851072865",
"131981932534430718235790722986976300445",
"50108084131301767556153565183425655764",
"52387072951618511809159250940391156521",
"300597919904524006162282907692709035850",
"5172343128725440298529440812313954334",
"283048659800826084154135600045255896551",
"265367497138542602315995536633235393979",
"48901281957595069365906037347759827221",
"18842293918642740792871011493979732941",
"105185971326798362534791594600596272982",
"151027756189007905452583905215971355750",
"131388513089890240379140616369012750579",
"129432374420130015769964029772496778637",
"181617239157297510335893778047412704825",
"87796319722482043985402708612156328944"
],
"threshold": 0.9
},
"deprecated": false,
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e60230bc64355c80abe993d1719fdb318094e20"
},
{
"id": "CVE-2022-49661-cb5425a2",
"target": {
"function": "gs_can_open",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 2041.0,
"function_hash": "753760531083675542801068591300218770"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c1d806bc29ff7ffe0e2a023583c8720ed96cb0b0"
},
{
"id": "CVE-2022-49661-cc983785",
"target": {
"function": "gs_can_open",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 2499.0,
"function_hash": "31854814439523897803196170990058289635"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffb6cc6601ec7c8fa963dcf76025df4a02f2cf5c"
},
{
"id": "CVE-2022-49661-db978323",
"target": {
"function": "gs_can_close",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 599.0,
"function_hash": "271567806869674055663514468402295610451"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffb6cc6601ec7c8fa963dcf76025df4a02f2cf5c"
},
{
"id": "CVE-2022-49661-eae193fd",
"target": {
"function": "gs_can_open",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 2041.0,
"function_hash": "753760531083675542801068591300218770"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0b8e223998866b3e7b2895927d4e9689b0a80d8"
},
{
"id": "CVE-2022-49661-fd6c2829",
"target": {
"function": "gs_can_open",
"file": "drivers/net/can/usb/gs_usb.c"
},
"signature_version": "v1",
"digest": {
"length": 2499.0,
"function_hash": "31854814439523897803196170990058289635"
},
"deprecated": false,
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2bda24ef95c0311ab93bda00db40486acf30bd0a"
}
]