In the Linux kernel, the following vulnerability has been resolved:
ASoC: core: Fix use-after-free in sndsocexit()
KASAN reports a use-after-free:
BUG: KASAN: use-after-free in devicedel+0xb5b/0xc60 Read of size 8 at addr ffff888008655050 by task rmmod/387 CPU: 2 PID: 387 Comm: rmmod Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <TASK> dumpstacklvl+0x79/0x9a printreport+0x17f/0x47b kasanreport+0xbb/0xf0 devicedel+0xb5b/0xc60 platformdevicedel.part.0+0x24/0x200 platformdeviceunregister+0x2e/0x40 sndsocexit+0xa/0x22 [sndsoccore] _dosysdeletemodule.constprop.0+0x34f/0x5b0 dosyscall64+0x3a/0x90 entrySYSCALL64afterhwframe+0x63/0xcd ... </TASK>
It's bacause in sndsocinit(), sndsocutilinit() is possble to fail, but its ret is ignored, which makes socdummy_dev unregistered twice.
sndsocinit() sndsocutilinit() platformdeviceregistersimple(socdummydev) platformdriverregister() # fail platformdeviceunregister(socdummydev) platformdriverregister() # success ... sndsocexit() sndsocutilexit() # socdummy_dev will be unregistered for second time
To fix it, handle error and stop sndsocinit() when utilinit() fail. Also clean debugfs when utilinit() or driver_register() fail.
[
{
"id": "CVE-2022-49842-130862e1",
"deprecated": false,
"digest": {
"length": 100.0,
"function_hash": "49050647140830817592593067837935559515"
},
"signature_version": "v1",
"target": {
"function": "snd_soc_init",
"file": "sound/soc/soc-core.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ec27c53886c8963729885bcf2dd996eba2767a7"
},
{
"id": "CVE-2022-49842-15bd0493",
"deprecated": false,
"digest": {
"length": 100.0,
"function_hash": "49050647140830817592593067837935559515"
},
"signature_version": "v1",
"target": {
"function": "snd_soc_init",
"file": "sound/soc/soc-core.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41fad4f712e081acdfde8b59847f9f66eaf407a0"
},
{
"id": "CVE-2022-49842-1e59c1de",
"deprecated": false,
"digest": {
"length": 100.0,
"function_hash": "49050647140830817592593067837935559515"
},
"signature_version": "v1",
"target": {
"function": "snd_soc_init",
"file": "sound/soc/soc-core.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5674bd073c0fd9f620ca550c5ff08d0d429bdd9"
},
{
"id": "CVE-2022-49842-1f33088c",
"deprecated": false,
"digest": {
"line_hashes": [
"22238739121836382814771285217957588835",
"134468108044180594464080946737617008059",
"107668194959051286844455751359729671992",
"124532782718101498060102753246571598652",
"207507555982877767389056455923612652154",
"235296245618576288737855811211369810694",
"277312320708691870584088774282796501219"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/soc/soc-core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ec3f558db343b045a7c7419cdbaec266b8ac1a7"
},
{
"id": "CVE-2022-49842-2d9c3c7d",
"deprecated": false,
"digest": {
"line_hashes": [
"22238739121836382814771285217957588835",
"134468108044180594464080946737617008059",
"107668194959051286844455751359729671992",
"124532782718101498060102753246571598652",
"207507555982877767389056455923612652154",
"235296245618576288737855811211369810694",
"277312320708691870584088774282796501219"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/soc/soc-core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41fad4f712e081acdfde8b59847f9f66eaf407a0"
},
{
"id": "CVE-2022-49842-2f4ca2c0",
"deprecated": false,
"digest": {
"line_hashes": [
"22238739121836382814771285217957588835",
"134468108044180594464080946737617008059",
"107668194959051286844455751359729671992",
"124532782718101498060102753246571598652",
"207507555982877767389056455923612652154",
"235296245618576288737855811211369810694",
"277312320708691870584088774282796501219"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/soc/soc-core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3365e62239dc064019a244bde5686ac18527c22"
},
{
"id": "CVE-2022-49842-2fe28e3d",
"deprecated": false,
"digest": {
"length": 100.0,
"function_hash": "49050647140830817592593067837935559515"
},
"signature_version": "v1",
"target": {
"function": "snd_soc_init",
"file": "sound/soc/soc-core.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ec3f558db343b045a7c7419cdbaec266b8ac1a7"
},
{
"id": "CVE-2022-49842-3226dd21",
"deprecated": false,
"digest": {
"length": 100.0,
"function_hash": "49050647140830817592593067837935559515"
},
"signature_version": "v1",
"target": {
"function": "snd_soc_init",
"file": "sound/soc/soc-core.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34eee4189bcebbd5f6a2ff25ef0cb893ad33d51e"
},
{
"id": "CVE-2022-49842-69d2e8b9",
"deprecated": false,
"digest": {
"length": 100.0,
"function_hash": "49050647140830817592593067837935559515"
},
"signature_version": "v1",
"target": {
"function": "snd_soc_init",
"file": "sound/soc/soc-core.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bbdf30a51e42378cb23a312005a022794b8e1e"
},
{
"id": "CVE-2022-49842-71b38146",
"deprecated": false,
"digest": {
"line_hashes": [
"317887869024765609433232876869430996574",
"257802154485690223882482334210763782153",
"107668194959051286844455751359729671992",
"124532782718101498060102753246571598652",
"207507555982877767389056455923612652154",
"235296245618576288737855811211369810694",
"277312320708691870584088774282796501219"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/soc/soc-core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6ec27c53886c8963729885bcf2dd996eba2767a7"
},
{
"id": "CVE-2022-49842-740f40c4",
"deprecated": false,
"digest": {
"length": 100.0,
"function_hash": "49050647140830817592593067837935559515"
},
"signature_version": "v1",
"target": {
"function": "snd_soc_init",
"file": "sound/soc/soc-core.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3365e62239dc064019a244bde5686ac18527c22"
},
{
"id": "CVE-2022-49842-88a21da0",
"deprecated": false,
"digest": {
"line_hashes": [
"22238739121836382814771285217957588835",
"134468108044180594464080946737617008059",
"107668194959051286844455751359729671992",
"124532782718101498060102753246571598652",
"207507555982877767389056455923612652154",
"235296245618576288737855811211369810694",
"277312320708691870584088774282796501219"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/soc/soc-core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@34eee4189bcebbd5f6a2ff25ef0cb893ad33d51e"
},
{
"id": "CVE-2022-49842-8db4f433",
"deprecated": false,
"digest": {
"line_hashes": [
"22238739121836382814771285217957588835",
"134468108044180594464080946737617008059",
"107668194959051286844455751359729671992",
"124532782718101498060102753246571598652",
"207507555982877767389056455923612652154",
"235296245618576288737855811211369810694",
"277312320708691870584088774282796501219"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/soc/soc-core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90bbdf30a51e42378cb23a312005a022794b8e1e"
},
{
"id": "CVE-2022-49842-9dff7bc5",
"deprecated": false,
"digest": {
"length": 100.0,
"function_hash": "49050647140830817592593067837935559515"
},
"signature_version": "v1",
"target": {
"function": "snd_soc_init",
"file": "sound/soc/soc-core.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d21554ec7680e9585fb852d933203c3db60dad1"
},
{
"id": "CVE-2022-49842-ac913d88",
"deprecated": false,
"digest": {
"line_hashes": [
"317887869024765609433232876869430996574",
"257802154485690223882482334210763782153",
"107668194959051286844455751359729671992",
"124532782718101498060102753246571598652",
"207507555982877767389056455923612652154",
"235296245618576288737855811211369810694",
"277312320708691870584088774282796501219"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/soc/soc-core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c5674bd073c0fd9f620ca550c5ff08d0d429bdd9"
},
{
"id": "CVE-2022-49842-d3655203",
"deprecated": false,
"digest": {
"line_hashes": [
"22238739121836382814771285217957588835",
"134468108044180594464080946737617008059",
"107668194959051286844455751359729671992",
"124532782718101498060102753246571598652",
"207507555982877767389056455923612652154",
"235296245618576288737855811211369810694",
"277312320708691870584088774282796501219"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "sound/soc/soc-core.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d21554ec7680e9585fb852d933203c3db60dad1"
}
]