In the Linux kernel, the following vulnerability has been resolved:
platform/chrome: crosusbpdnotify: Fix error handling in crosusbpdnotify_init()
The following WARNING message was given when rmmod crosusbpdnotify:
Unexpected driver unregister! WARNING: CPU: 0 PID: 253 at drivers/base/driver.c:270 driverunregister+0x8a/0xb0 Modules linked in: crosusbpdnotify(-) CPU: 0 PID: 253 Comm: rmmod Not tainted 6.1.0-rc3 #24 ... Call Trace: <TASK> crosusbpdnotifyexit+0x11/0x1e [crosusbpdnotify] __x64sysdelete_module+0x3c7/0x570 ? __ia32sysdeletemodule+0x570/0x570 ? lockisheldtype+0xe3/0x140 ? syscallenterfromusermode+0x17/0x50 ? rcureadlockschedheld+0xa0/0xd0 ? syscallenterfromusermode+0x1c/0x50 dosyscall64+0x37/0x90 entrySYSCALL64afterhwframe+0x63/0xcd RIP: 0033:0x7f333fe9b1b7
The reason is that the crosusbpdnotifyinit() does not check the return value of platformdriverregister(), and the crosusbpdnotify can install successfully even if platformdriver_register() failed.
Fix by checking the return value of platformdriverregister() and unregister crosusbpdnotifyplatdriver when it failed.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50468.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50468.json"
[
{
"signature_version": "v1",
"target": {
"file": "drivers/platform/chrome/cros_usbpd_notify.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0cacdd354987f8f5348d16908716f154047890",
"deprecated": false,
"digest": {
"line_hashes": [
"95650271559034545307808771942837255803",
"32559996761118365525936764032003878133",
"263832092961053960860173507627791564326",
"108925990323853307010736964917524883972"
],
"threshold": 0.9
},
"id": "CVE-2022-50468-59391c48",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/platform/chrome/cros_usbpd_notify.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a2d96623670155d94aca72c320c0ac27bdc6bd2",
"deprecated": false,
"digest": {
"line_hashes": [
"95650271559034545307808771942837255803",
"32559996761118365525936764032003878133",
"263832092961053960860173507627791564326",
"108925990323853307010736964917524883972"
],
"threshold": 0.9
},
"id": "CVE-2022-50468-6ee1e476",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/platform/chrome/cros_usbpd_notify.c",
"function": "cros_usbpd_notify_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5a2d96623670155d94aca72c320c0ac27bdc6bd2",
"deprecated": false,
"digest": {
"function_hash": "159224670634311890346733960709475005361",
"length": 214.0
},
"id": "CVE-2022-50468-af41293a",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "drivers/platform/chrome/cros_usbpd_notify.c",
"function": "cros_usbpd_notify_init"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c0cacdd354987f8f5348d16908716f154047890",
"deprecated": false,
"digest": {
"function_hash": "159224670634311890346733960709475005361",
"length": 214.0
},
"id": "CVE-2022-50468-da46b40b",
"signature_type": "Function"
}
]