CVE-2022-50005

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-50005
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50005.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-50005
Downstream
Related
Published
2025-06-18T11:01:10Z
Modified
2025-10-21T12:01:21.193242Z
Summary
nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
Details

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Fix use-after-free bugs caused by pn532cmdtimeout

When the pn532 uart device is detaching, the pn532uartremove() is called. But there are no functions in pn532uartremove() that could delete the cmd_timeout timer, which will cause use-after-free bugs. The process is shown below:

(thread 1)                  |        (thread 2)
                            |  pn532_uart_send_frame

pn532uartremove | modtimer(&pn532->cmdtimeout,...) ... | (wait a time) kfree(pn532) //FREE | pn532cmdtimeout | pn532uartsend_frame | pn532->... //USE

This patch adds deltimersync() in pn532uartremove() in order to prevent the use-after-free bugs. What's more, the pn53xunregisternfc() is well synchronized, it sets nfcdev->shuttingdown to true and there are no syscalls could restart the cmd_timeout timer.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c656aa4c27b17a8c70da223ed5ab42145800d6b5
Fixed
50403ee6daddf0d7a14e9d3b51a377c39a08ec8c
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c656aa4c27b17a8c70da223ed5ab42145800d6b5
Fixed
9c34c33893db7a80d0e4b55c23d3b65e29609cfb
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c656aa4c27b17a8c70da223ed5ab42145800d6b5
Fixed
2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c656aa4c27b17a8c70da223ed5ab42145800d6b5
Fixed
f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6

Affected versions

v5.*

v5.10
v5.10-rc1
v5.10-rc2
v5.10-rc3
v5.10-rc4
v5.10-rc5
v5.10-rc6
v5.10-rc7
v5.10.1
v5.10.10
v5.10.100
v5.10.101
v5.10.102
v5.10.103
v5.10.104
v5.10.105
v5.10.106
v5.10.107
v5.10.108
v5.10.109
v5.10.11
v5.10.110
v5.10.111
v5.10.112
v5.10.113
v5.10.114
v5.10.115
v5.10.116
v5.10.117
v5.10.118
v5.10.119
v5.10.12
v5.10.120
v5.10.121
v5.10.122
v5.10.123
v5.10.124
v5.10.125
v5.10.126
v5.10.127
v5.10.128
v5.10.129
v5.10.13
v5.10.130
v5.10.131
v5.10.132
v5.10.133
v5.10.134
v5.10.135
v5.10.136
v5.10.137
v5.10.138
v5.10.139
v5.10.14
v5.10.15
v5.10.16
v5.10.17
v5.10.18
v5.10.19
v5.10.2
v5.10.20
v5.10.21
v5.10.22
v5.10.23
v5.10.24
v5.10.25
v5.10.26
v5.10.27
v5.10.28
v5.10.29
v5.10.3
v5.10.30
v5.10.31
v5.10.32
v5.10.33
v5.10.34
v5.10.35
v5.10.36
v5.10.37
v5.10.38
v5.10.39
v5.10.4
v5.10.40
v5.10.41
v5.10.42
v5.10.43
v5.10.44
v5.10.45
v5.10.46
v5.10.47
v5.10.48
v5.10.49
v5.10.5
v5.10.50
v5.10.51
v5.10.52
v5.10.53
v5.10.54
v5.10.55
v5.10.56
v5.10.57
v5.10.58
v5.10.59
v5.10.6
v5.10.60
v5.10.61
v5.10.62
v5.10.63
v5.10.64
v5.10.65
v5.10.66
v5.10.67
v5.10.68
v5.10.69
v5.10.7
v5.10.70
v5.10.71
v5.10.72
v5.10.73
v5.10.74
v5.10.75
v5.10.76
v5.10.77
v5.10.78
v5.10.79
v5.10.8
v5.10.80
v5.10.81
v5.10.82
v5.10.83
v5.10.84
v5.10.85
v5.10.86
v5.10.87
v5.10.88
v5.10.89
v5.10.9
v5.10.90
v5.10.91
v5.10.92
v5.10.93
v5.10.94
v5.10.95
v5.10.96
v5.10.97
v5.10.98
v5.10.99
v5.11
v5.11-rc1
v5.11-rc2
v5.11-rc3
v5.11-rc4
v5.11-rc5
v5.11-rc6
v5.11-rc7
v5.12
v5.12-rc1
v5.12-rc1-dontuse
v5.12-rc2
v5.12-rc3
v5.12-rc4
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.15.1
v5.15.10
v5.15.11
v5.15.12
v5.15.13
v5.15.14
v5.15.15
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.2
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.26
v5.15.27
v5.15.28
v5.15.29
v5.15.3
v5.15.30
v5.15.31
v5.15.32
v5.15.33
v5.15.34
v5.15.35
v5.15.36
v5.15.37
v5.15.38
v5.15.39
v5.15.4
v5.15.40
v5.15.41
v5.15.42
v5.15.43
v5.15.44
v5.15.45
v5.15.46
v5.15.47
v5.15.48
v5.15.49
v5.15.5
v5.15.50
v5.15.51
v5.15.52
v5.15.53
v5.15.54
v5.15.55
v5.15.56
v5.15.57
v5.15.58
v5.15.59
v5.15.6
v5.15.60
v5.15.61
v5.15.62
v5.15.63
v5.15.7
v5.15.8
v5.15.9
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v5.19.1
v5.19.2
v5.19.3
v5.19.4
v5.19.5
v5.4
v5.4-rc4
v5.4-rc5
v5.4-rc6
v5.4-rc7
v5.4-rc8
v5.5
v5.5-rc1
v5.5-rc2
v5.5-rc3
v5.5-rc4
v5.5-rc5
v5.5-rc6
v5.5-rc7
v5.6
v5.6-rc1
v5.6-rc2
v5.6-rc3
v5.6-rc4
v5.6-rc5
v5.6-rc6
v5.6-rc7
v5.7
v5.7-rc1
v5.7-rc2
v5.7-rc3
v5.7-rc4
v5.7-rc5
v5.7-rc6
v5.7-rc7
v5.8
v5.8-rc1
v5.8-rc2
v5.8-rc3
v5.8-rc4
v5.8-rc5
v5.8-rc6
v5.8-rc7
v5.9
v5.9-rc1
v5.9-rc2
v5.9-rc3
v5.9-rc4
v5.9-rc5
v5.9-rc6
v5.9-rc7
v5.9-rc8

v6.*

v6.0-rc1

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50403ee6daddf0d7a14e9d3b51a377c39a08ec8c",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "88619933688473618601352440553021032392",
                "253263083140660518877230065828378900439",
                "190131959274673970392783829298598515050",
                "242139340830483650609202003611833987715"
            ]
        },
        "target": {
            "file": "drivers/nfc/pn533/uart.c"
        },
        "id": "CVE-2022-50005-0a0d6d17",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "88619933688473618601352440553021032392",
                "253263083140660518877230065828378900439",
                "190131959274673970392783829298598515050",
                "242139340830483650609202003611833987715"
            ]
        },
        "target": {
            "file": "drivers/nfc/pn533/uart.c"
        },
        "id": "CVE-2022-50005-102cdfa2",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@50403ee6daddf0d7a14e9d3b51a377c39a08ec8c",
        "deprecated": false,
        "digest": {
            "function_hash": "334885566728348843486370018583808618662",
            "length": 203.0
        },
        "target": {
            "function": "pn532_uart_remove",
            "file": "drivers/nfc/pn533/uart.c"
        },
        "id": "CVE-2022-50005-355fdf81",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6",
        "deprecated": false,
        "digest": {
            "function_hash": "334885566728348843486370018583808618662",
            "length": 203.0
        },
        "target": {
            "function": "pn532_uart_remove",
            "file": "drivers/nfc/pn533/uart.c"
        },
        "id": "CVE-2022-50005-72a599d6",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c34c33893db7a80d0e4b55c23d3b65e29609cfb",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "88619933688473618601352440553021032392",
                "253263083140660518877230065828378900439",
                "190131959274673970392783829298598515050",
                "242139340830483650609202003611833987715"
            ]
        },
        "target": {
            "file": "drivers/nfc/pn533/uart.c"
        },
        "id": "CVE-2022-50005-9fa5f95c",
        "signature_version": "v1",
        "signature_type": "Line"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9c34c33893db7a80d0e4b55c23d3b65e29609cfb",
        "deprecated": false,
        "digest": {
            "function_hash": "334885566728348843486370018583808618662",
            "length": 203.0
        },
        "target": {
            "function": "pn532_uart_remove",
            "file": "drivers/nfc/pn533/uart.c"
        },
        "id": "CVE-2022-50005-b3ed40d6",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5",
        "deprecated": false,
        "digest": {
            "function_hash": "334885566728348843486370018583808618662",
            "length": 203.0
        },
        "target": {
            "function": "pn532_uart_remove",
            "file": "drivers/nfc/pn533/uart.c"
        },
        "id": "CVE-2022-50005-b7e8cb0b",
        "signature_version": "v1",
        "signature_type": "Function"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "88619933688473618601352440553021032392",
                "253263083140660518877230065828378900439",
                "190131959274673970392783829298598515050",
                "242139340830483650609202003611833987715"
            ]
        },
        "target": {
            "file": "drivers/nfc/pn533/uart.c"
        },
        "id": "CVE-2022-50005-f2d83545",
        "signature_version": "v1",
        "signature_type": "Line"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.140
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.64
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.19.6