In the Linux kernel, the following vulnerability has been resolved:
usbnet: Fix linkwatch use-after-free on disconnect
usbnet uses the work usbnetdeferredkevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":
https://git.kernel.org/tglx/history/c/0f138bbfd83c
The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of all work by calling flushscheduledwork(), and that could deadlock when waiting for usbnetdeferredkevent() with rtnlmutex held in ->ndostop().
The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asixdevices.c, ax88179178a.c, ch9200.c and smsc75xx.c:
Because usbnetdeferredkevent() is awaited after unregisternetdev(), netifcarrier{on,off}() may operate on an unregistered netdev and linkwatchevent() may run after free_netdev(), causing a use-after-free.
In 2010, usbnet was changed to only wait for a single instance of usbnetdeferredkevent() instead of all work by commit 23f333a2bfaf ("drivers/net: don't use flushscheduledwork()").
Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a521a7dcc463c5017b4426ca0804e151faeff7", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_disconnect" }, "digest": { "length": 700.0, "function_hash": "257303908142239616003180606242789317062" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-0b5167c5" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@635fd8953e4309b54ca6a81bed1d4a87668694f4", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_disconnect" }, "digest": { "length": 699.0, "function_hash": "195319617051540644775925262000810424679" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-0bdae62c" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4588b8b00b299be16a35be67b331d8fdba03f3", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "278900393243480812652450896941200373118", "45455766125422907174281374765420470863", "319738374561331820377855093822831482949", "171809013308668227401593995595793615096", "73935018760076018381323784146082406401", "141318705920221491961833268441373971664", "131349906846676331128300327236638829696", "166392942436145542774748319556718211629", "11222751786951024695275791929379731900", "47327619861628152609496495243838484596" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-50220-0e4252ae" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69e617e533edddf3fa3123149900f36e0a6dc74", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_stop" }, "digest": { "length": 1075.0, "function_hash": "18189662499944157438246541627815399271" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-1bfc0896" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4588b8b00b299be16a35be67b331d8fdba03f3", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_stop" }, "digest": { "length": 1075.0, "function_hash": "18189662499944157438246541627815399271" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-293c17c4" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a521a7dcc463c5017b4426ca0804e151faeff7", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_stop" }, "digest": { "length": 1069.0, "function_hash": "182546085233237533166133839191497467769" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-2ea4a720" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "278900393243480812652450896941200373118", "45455766125422907174281374765420470863", "319738374561331820377855093822831482949", "171809013308668227401593995595793615096", "73935018760076018381323784146082406401", "141318705920221491961833268441373971664", "131349906846676331128300327236638829696", "166392942436145542774748319556718211629", "11222751786951024695275791929379731900", "47327619861628152609496495243838484596" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-50220-3acd871c" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2d6b530d89b0a912148018027386aa049f0a309", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "278900393243480812652450896941200373118", "45455766125422907174281374765420470863", "319738374561331820377855093822831482949", "171809013308668227401593995595793615096", "73935018760076018381323784146082406401", "141318705920221491961833268441373971664", "131349906846676331128300327236638829696", "166392942436145542774748319556718211629", "11222751786951024695275791929379731900", "47327619861628152609496495243838484596" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-50220-3aef5ca1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77dcbc030c2faa6d8e8a594985eeb34018409e", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "278900393243480812652450896941200373118", "45455766125422907174281374765420470863", "319738374561331820377855093822831482949", "171809013308668227401593995595793615096", "73935018760076018381323784146082406401", "141318705920221491961833268441373971664", "131349906846676331128300327236638829696", "166392942436145542774748319556718211629", "11222751786951024695275791929379731900", "47327619861628152609496495243838484596" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-50220-47d83e65" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2a521a7dcc463c5017b4426ca0804e151faeff7", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "278900393243480812652450896941200373118", "45455766125422907174281374765420470863", "319738374561331820377855093822831482949", "171809013308668227401593995595793615096", "73935018760076018381323784146082406401", "141318705920221491961833268441373971664", "131349906846676331128300327236638829696", "166392942436145542774748319556718211629", "11222751786951024695275791929379731900", "47327619861628152609496495243838484596" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-50220-5202d880" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77dcbc030c2faa6d8e8a594985eeb34018409e", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_disconnect" }, "digest": { "length": 700.0, "function_hash": "257303908142239616003180606242789317062" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-59da8d76" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69e617e533edddf3fa3123149900f36e0a6dc74", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "278900393243480812652450896941200373118", "45455766125422907174281374765420470863", "319738374561331820377855093822831482949", "171809013308668227401593995595793615096", "73935018760076018381323784146082406401", "141318705920221491961833268441373971664", "131349906846676331128300327236638829696", "166392942436145542774748319556718211629", "11222751786951024695275791929379731900", "47327619861628152609496495243838484596" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-50220-7399fa1c" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135199a2edd459d2b123144efcd7f9bcd95128e4", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_disconnect" }, "digest": { "length": 700.0, "function_hash": "257303908142239616003180606242789317062" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-8a7b19ea" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_disconnect" }, "digest": { "length": 699.0, "function_hash": "195319617051540644775925262000810424679" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-8fb04f7a" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135199a2edd459d2b123144efcd7f9bcd95128e4", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "278900393243480812652450896941200373118", "45455766125422907174281374765420470863", "319738374561331820377855093822831482949", "171809013308668227401593995595793615096", "73935018760076018381323784146082406401", "141318705920221491961833268441373971664", "131349906846676331128300327236638829696", "166392942436145542774748319556718211629", "11222751786951024695275791929379731900", "47327619861628152609496495243838484596" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-50220-99ae7d0b" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2d6b530d89b0a912148018027386aa049f0a309", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_stop" }, "digest": { "length": 1069.0, "function_hash": "182546085233237533166133839191497467769" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-ad23b0cd" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77dcbc030c2faa6d8e8a594985eeb34018409e", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_stop" }, "digest": { "length": 1069.0, "function_hash": "182546085233237533166133839191497467769" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-b97d2131" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a69e617e533edddf3fa3123149900f36e0a6dc74", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_disconnect" }, "digest": { "length": 699.0, "function_hash": "195319617051540644775925262000810424679" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-d3c5e5db" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@635fd8953e4309b54ca6a81bed1d4a87668694f4", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "278900393243480812652450896941200373118", "45455766125422907174281374765420470863", "319738374561331820377855093822831482949", "171809013308668227401593995595793615096", "73935018760076018381323784146082406401", "141318705920221491961833268441373971664", "131349906846676331128300327236638829696", "166392942436145542774748319556718211629", "11222751786951024695275791929379731900", "47327619861628152609496495243838484596" ] }, "deprecated": false, "signature_type": "Line", "id": "CVE-2022-50220-dfb283e4" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_stop" }, "digest": { "length": 1075.0, "function_hash": "18189662499944157438246541627815399271" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-e17a5560" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@635fd8953e4309b54ca6a81bed1d4a87668694f4", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_stop" }, "digest": { "length": 1075.0, "function_hash": "18189662499944157438246541627815399271" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-e5dd4261" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b4588b8b00b299be16a35be67b331d8fdba03f3", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_disconnect" }, "digest": { "length": 700.0, "function_hash": "257303908142239616003180606242789317062" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-ed0d1b94" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2d6b530d89b0a912148018027386aa049f0a309", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_disconnect" }, "digest": { "length": 670.0, "function_hash": "111353379502574254965117050065584578211" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-ede83868" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@135199a2edd459d2b123144efcd7f9bcd95128e4", "signature_version": "v1", "target": { "file": "drivers/net/usb/usbnet.c", "function": "usbnet_stop" }, "digest": { "length": 1075.0, "function_hash": "18189662499944157438246541627815399271" }, "deprecated": false, "signature_type": "Function", "id": "CVE-2022-50220-f4ffdee6" } ]