In the Linux kernel, the following vulnerability has been resolved:
usbnet: Fix linkwatch use-after-free on disconnect
usbnet uses the work usbnetdeferredkevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":
https://git.kernel.org/tglx/history/c/0f138bbfd83c
The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of all work by calling flushscheduledwork(), and that could deadlock when waiting for usbnetdeferredkevent() with rtnlmutex held in ->ndostop().
The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asixdevices.c, ax88179178a.c, ch9200.c and smsc75xx.c:
Because usbnetdeferredkevent() is awaited after unregisternetdev(), netifcarrier_{on,off}() may operate on an unregistered netdev and linkwatchevent() may run after freenetdev(), causing a use-after-free.
In 2010, usbnet was changed to only wait for a single instance of usbnetdeferredkevent() instead of all work by commit 23f333a2bfaf ("drivers/net: don't use flushscheduledwork()").
Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50220.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
},
"id": "CVE-2022-50220-0b5167c5",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a521a7dcc463c5017b4426ca0804e151faeff7",
"digest": {
"function_hash": "257303908142239616003180606242789317062",
"length": 700.0
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
},
"id": "CVE-2022-50220-0bdae62c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@635fd8953e4309b54ca6a81bed1d4a87668694f4",
"digest": {
"function_hash": "195319617051540644775925262000810424679",
"length": 699.0
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50220-0e4252ae",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4588b8b00b299be16a35be67b331d8fdba03f3",
"target": {
"file": "drivers/net/usb/usbnet.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "18189662499944157438246541627815399271",
"length": 1075.0
},
"id": "CVE-2022-50220-1bfc0896",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69e617e533edddf3fa3123149900f36e0a6dc74",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "18189662499944157438246541627815399271",
"length": 1075.0
},
"deprecated": false,
"id": "CVE-2022-50220-293c17c4",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4588b8b00b299be16a35be67b331d8fdba03f3",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "182546085233237533166133839191497467769",
"length": 1069.0
},
"signature_version": "v1",
"id": "CVE-2022-50220-2ea4a720",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a521a7dcc463c5017b4426ca0804e151faeff7",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
},
"id": "CVE-2022-50220-3acd871c",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f",
"target": {
"file": "drivers/net/usb/usbnet.c"
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/net/usb/usbnet.c"
},
"id": "CVE-2022-50220-3aef5ca1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2d6b530d89b0a912148018027386aa049f0a309",
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
},
"id": "CVE-2022-50220-47d83e65",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77dcbc030c2faa6d8e8a594985eeb34018409e",
"target": {
"file": "drivers/net/usb/usbnet.c"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "195319617051540644775925262000810424679",
"length": 699.0
},
"signature_version": "v1",
"id": "CVE-2022-50220-50f037eb",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db3b738ae5f726204876f4303c49cfdf4311403f",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
}
},
{
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/usbnet.c"
},
"deprecated": false,
"id": "CVE-2022-50220-5202d880",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a521a7dcc463c5017b4426ca0804e151faeff7",
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
},
"id": "CVE-2022-50220-59da8d76",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77dcbc030c2faa6d8e8a594985eeb34018409e",
"digest": {
"function_hash": "257303908142239616003180606242789317062",
"length": 700.0
}
},
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/net/usb/usbnet.c"
},
"id": "CVE-2022-50220-7399fa1c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69e617e533edddf3fa3123149900f36e0a6dc74",
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
}
},
{
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
},
"id": "CVE-2022-50220-8a7b19ea",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135199a2edd459d2b123144efcd7f9bcd95128e4",
"digest": {
"function_hash": "257303908142239616003180606242789317062",
"length": 700.0
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "195319617051540644775925262000810424679",
"length": 699.0
},
"signature_version": "v1",
"id": "CVE-2022-50220-8fb04f7a",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
},
"id": "CVE-2022-50220-99ae7d0b",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135199a2edd459d2b123144efcd7f9bcd95128e4",
"target": {
"file": "drivers/net/usb/usbnet.c"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "182546085233237533166133839191497467769",
"length": 1069.0
},
"signature_version": "v1",
"id": "CVE-2022-50220-ad23b0cd",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2d6b530d89b0a912148018027386aa049f0a309",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "18189662499944157438246541627815399271",
"length": 1075.0
},
"signature_version": "v1",
"id": "CVE-2022-50220-b79f1531",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db3b738ae5f726204876f4303c49cfdf4311403f",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "182546085233237533166133839191497467769",
"length": 1069.0
},
"signature_version": "v1",
"id": "CVE-2022-50220-b97d2131",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77dcbc030c2faa6d8e8a594985eeb34018409e",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "195319617051540644775925262000810424679",
"length": 699.0
},
"signature_version": "v1",
"id": "CVE-2022-50220-d3c5e5db",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69e617e533edddf3fa3123149900f36e0a6dc74",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
},
"id": "CVE-2022-50220-dfb283e4",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@635fd8953e4309b54ca6a81bed1d4a87668694f4",
"target": {
"file": "drivers/net/usb/usbnet.c"
}
},
{
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
},
"deprecated": false,
"id": "CVE-2022-50220-e17a5560",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f",
"digest": {
"function_hash": "18189662499944157438246541627815399271",
"length": 1075.0
}
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"function_hash": "18189662499944157438246541627815399271",
"length": 1075.0
},
"id": "CVE-2022-50220-e5dd4261",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@635fd8953e4309b54ca6a81bed1d4a87668694f4",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "257303908142239616003180606242789317062",
"length": 700.0
},
"deprecated": false,
"id": "CVE-2022-50220-ed0d1b94",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4588b8b00b299be16a35be67b331d8fdba03f3",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
}
},
{
"signature_type": "Function",
"digest": {
"function_hash": "111353379502574254965117050065584578211",
"length": 670.0
},
"signature_version": "v1",
"id": "CVE-2022-50220-ede83868",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2d6b530d89b0a912148018027386aa049f0a309",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_disconnect"
}
},
{
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/usbnet.c",
"function": "usbnet_stop"
},
"deprecated": false,
"id": "CVE-2022-50220-f4ffdee6",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135199a2edd459d2b123144efcd7f9bcd95128e4",
"digest": {
"function_hash": "18189662499944157438246541627815399271",
"length": 1075.0
}
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"278900393243480812652450896941200373118",
"45455766125422907174281374765420470863",
"319738374561331820377855093822831482949",
"171809013308668227401593995595793615096",
"73935018760076018381323784146082406401",
"141318705920221491961833268441373971664",
"131349906846676331128300327236638829696",
"166392942436145542774748319556718211629",
"11222751786951024695275791929379731900",
"47327619861628152609496495243838484596"
],
"threshold": 0.9
},
"signature_version": "v1",
"id": "CVE-2022-50220-f949b1dd",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db3b738ae5f726204876f4303c49cfdf4311403f",
"target": {
"file": "drivers/net/usb/usbnet.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50220.json"