In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: ffs: Prevent race during ffsep0queuewait
While performing fast composition switch, there is a possibility that the process of ffsep0write/ffsep0read get into a race condition due to ep0req being freed up from functionfs_unbind.
Consider the scenario that the ffsep0write calls the ffsep0queuewait by taking a lock &ffs->ev.waitq.lock. However, the functionfsunbind isn't bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffsep0queue_wait we will end up in use-after-free.
Fix this by making a serialized execution between the two functions using a mutex_lock(ffs->mutex).
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@facf353c9e8d7885b686d9a4b173d4e0af6441d2",
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-04e0f91c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304349793883623218911144269457601351411",
"143995131420015720964763974741304276983",
"10932849423577629114549464536211778080",
"4353011887991948994025562082582762283",
"32578138928819988684584757801377579653",
"157717721279106970506969813151903821020",
"173488336848950298395537413419909661602",
"165254369519283711607186903452509640941",
"187738590398742881546238712816417014306",
"320278318636046032978911428967723450475",
"51623801610774545597480582940449536424"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@facf353c9e8d7885b686d9a4b173d4e0af6441d2",
"target": {
"function": "__ffs_ep0_queue_wait",
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-0d3c435c",
"digest": {
"length": 717.0,
"function_hash": "93245140710420027695819475439845483604"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8d40942df074f4ebcb9bd3413596d92f323b064",
"target": {
"function": "functionfs_unbind",
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-1a7b81ee",
"digest": {
"length": 276.0,
"function_hash": "286411711007777385100782229898852567139"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4",
"target": {
"function": "functionfs_unbind",
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-1d7804cd",
"digest": {
"length": 276.0,
"function_hash": "286411711007777385100782229898852567139"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae8e136bcaae96163b5821984de1036efc9abb1a",
"target": {
"function": "functionfs_unbind",
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-2094a088",
"digest": {
"length": 276.0,
"function_hash": "286411711007777385100782229898852567139"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a19da111057f69214b97c62fb0ac59023970850",
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-21e524ff",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304349793883623218911144269457601351411",
"143995131420015720964763974741304276983",
"10932849423577629114549464536211778080",
"4353011887991948994025562082582762283",
"32578138928819988684584757801377579653",
"157717721279106970506969813151903821020",
"173488336848950298395537413419909661602",
"165254369519283711607186903452509640941",
"187738590398742881546238712816417014306",
"320278318636046032978911428967723450475",
"51623801610774545597480582940449536424"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a19da111057f69214b97c62fb0ac59023970850",
"target": {
"function": "functionfs_unbind",
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-27ff32b9",
"digest": {
"length": 276.0,
"function_hash": "286411711007777385100782229898852567139"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8d40942df074f4ebcb9bd3413596d92f323b064",
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-31ca3bfa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304349793883623218911144269457601351411",
"143995131420015720964763974741304276983",
"10932849423577629114549464536211778080",
"4353011887991948994025562082582762283",
"32578138928819988684584757801377579653",
"157717721279106970506969813151903821020",
"173488336848950298395537413419909661602",
"165254369519283711607186903452509640941",
"187738590398742881546238712816417014306",
"320278318636046032978911428967723450475",
"51623801610774545597480582940449536424"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6aee197b7fbcd61596a78b47d553f2f99111f217",
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-49cbc250",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304349793883623218911144269457601351411",
"143995131420015720964763974741304276983",
"10932849423577629114549464536211778080",
"4353011887991948994025562082582762283",
"32578138928819988684584757801377579653",
"157717721279106970506969813151903821020",
"173488336848950298395537413419909661602",
"165254369519283711607186903452509640941",
"187738590398742881546238712816417014306",
"320278318636046032978911428967723450475",
"51623801610774545597480582940449536424"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae8e136bcaae96163b5821984de1036efc9abb1a",
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-9e39ca82",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304349793883623218911144269457601351411",
"143995131420015720964763974741304276983",
"10932849423577629114549464536211778080",
"4353011887991948994025562082582762283",
"32578138928819988684584757801377579653",
"157717721279106970506969813151903821020",
"173488336848950298395537413419909661602",
"165254369519283711607186903452509640941",
"187738590398742881546238712816417014306",
"320278318636046032978911428967723450475",
"51623801610774545597480582940449536424"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9036e951f93fb8d7b5e9d6e2c7f94a4da312ae4",
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-9f25d86f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304349793883623218911144269457601351411",
"143995131420015720964763974741304276983",
"10932849423577629114549464536211778080",
"4353011887991948994025562082582762283",
"32578138928819988684584757801377579653",
"157717721279106970506969813151903821020",
"173488336848950298395537413419909661602",
"165254369519283711607186903452509640941",
"187738590398742881546238712816417014306",
"320278318636046032978911428967723450475",
"51623801610774545597480582940449536424"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6dd9ea05534f323668db94fcc2726c7a84547e78",
"target": {
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-b31db4ee",
"digest": {
"threshold": 0.9,
"line_hashes": [
"304349793883623218911144269457601351411",
"143995131420015720964763974741304276983",
"10932849423577629114549464536211778080",
"4353011887991948994025562082582762283",
"32578138928819988684584757801377579653",
"157717721279106970506969813151903821020",
"173488336848950298395537413419909661602",
"165254369519283711607186903452509640941",
"187738590398742881546238712816417014306",
"320278318636046032978911428967723450475",
"51623801610774545597480582940449536424"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6dd9ea05534f323668db94fcc2726c7a84547e78",
"target": {
"function": "functionfs_unbind",
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-b9ddb221",
"digest": {
"length": 276.0,
"function_hash": "286411711007777385100782229898852567139"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@facf353c9e8d7885b686d9a4b173d4e0af6441d2",
"target": {
"function": "functionfs_unbind",
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-e2e9b548",
"digest": {
"length": 276.0,
"function_hash": "286411711007777385100782229898852567139"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6aee197b7fbcd61596a78b47d553f2f99111f217",
"target": {
"function": "functionfs_unbind",
"file": "drivers/usb/gadget/function/f_fs.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2022-49755-fb40a865",
"digest": {
"length": 276.0,
"function_hash": "286411711007777385100782229898852567139"
},
"signature_type": "Function"
}
]