In the Linux kernel, the following vulnerability has been resolved:
xhci: Remove device endpoints from bandwidth list when freeing the device
Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed.
If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller.
So check and delete endpoints that are still on the bandwidth list when freeing the virt device.
Solves a listdel corruption kernel crash when unbinding xhci-pci, caused by xhcimem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list.
This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f1cd9633d1f21efc13e8fc75be8f2b6bb85e38c",
"id": "CVE-2022-50470-0a35a1d8",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xhci_free_virt_device",
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Function",
"digest": {
"length": 1034.0,
"function_hash": "176819681802167519459735400156032440375"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0de39474078adef6ece7a183e34c15ce2c1d8d1",
"id": "CVE-2022-50470-14e4a582",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xhci_free_virt_device",
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Function",
"digest": {
"length": 1034.0,
"function_hash": "176819681802167519459735400156032440375"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c892a81c7424b4f6a660cb9c249d354ccf3afeca",
"id": "CVE-2022-50470-36a14e88",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xhci_free_virt_device",
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Function",
"digest": {
"length": 1034.0,
"function_hash": "176819681802167519459735400156032440375"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cebbc8d335d6bcc1316584f779c08f80287c6af8",
"id": "CVE-2022-50470-37514b10",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"203328417190141024497941210748150554263",
"339737746523717564329574078610209815545",
"258510718839241518633058044527163754500",
"11800172812982025669200662449781229143",
"280978771847100627308153064033943704454",
"338387709850464625672137448469131113033",
"52450109861551699291424720615251692164"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f1cd9633d1f21efc13e8fc75be8f2b6bb85e38c",
"id": "CVE-2022-50470-592863f7",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"203328417190141024497941210748150554263",
"339737746523717564329574078610209815545",
"258510718839241518633058044527163754500",
"11800172812982025669200662449781229143",
"280978771847100627308153064033943704454",
"338387709850464625672137448469131113033",
"52450109861551699291424720615251692164"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@678d2cc2041cc6ce05030852dce9ad42719abcfc",
"id": "CVE-2022-50470-5d03fd10",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"203328417190141024497941210748150554263",
"339737746523717564329574078610209815545",
"258510718839241518633058044527163754500",
"11800172812982025669200662449781229143",
"280978771847100627308153064033943704454",
"338387709850464625672137448469131113033",
"52450109861551699291424720615251692164"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cebbc8d335d6bcc1316584f779c08f80287c6af8",
"id": "CVE-2022-50470-7ff65b53",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xhci_free_virt_device",
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Function",
"digest": {
"length": 1034.0,
"function_hash": "176819681802167519459735400156032440375"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bf860a41e0f2fcea0ac3aae8f7ef887a7994b70",
"id": "CVE-2022-50470-8e641a68",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xhci_free_virt_device",
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Function",
"digest": {
"length": 1034.0,
"function_hash": "176819681802167519459735400156032440375"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0de39474078adef6ece7a183e34c15ce2c1d8d1",
"id": "CVE-2022-50470-9b0fc620",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"203328417190141024497941210748150554263",
"339737746523717564329574078610209815545",
"258510718839241518633058044527163754500",
"11800172812982025669200662449781229143",
"280978771847100627308153064033943704454",
"338387709850464625672137448469131113033",
"52450109861551699291424720615251692164"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c892a81c7424b4f6a660cb9c249d354ccf3afeca",
"id": "CVE-2022-50470-9cd39544",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"203328417190141024497941210748150554263",
"339737746523717564329574078610209815545",
"258510718839241518633058044527163754500",
"11800172812982025669200662449781229143",
"280978771847100627308153064033943704454",
"338387709850464625672137448469131113033",
"52450109861551699291424720615251692164"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aed5b7c2430ce318a8e62f752f181e66f0d1053",
"id": "CVE-2022-50470-9dba7f0d",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xhci_free_virt_device",
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Function",
"digest": {
"length": 1034.0,
"function_hash": "176819681802167519459735400156032440375"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3bf860a41e0f2fcea0ac3aae8f7ef887a7994b70",
"id": "CVE-2022-50470-9fb9e522",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"203328417190141024497941210748150554263",
"339737746523717564329574078610209815545",
"258510718839241518633058044527163754500",
"11800172812982025669200662449781229143",
"280978771847100627308153064033943704454",
"338387709850464625672137448469131113033",
"52450109861551699291424720615251692164"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e4ce28ad907aa54f13b21d5f1dc490525957b0c",
"id": "CVE-2022-50470-bfb58800",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"203328417190141024497941210748150554263",
"339737746523717564329574078610209815545",
"258510718839241518633058044527163754500",
"11800172812982025669200662449781229143",
"280978771847100627308153064033943704454",
"338387709850464625672137448469131113033",
"52450109861551699291424720615251692164"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5e4ce28ad907aa54f13b21d5f1dc490525957b0c",
"id": "CVE-2022-50470-d2e23277",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xhci_free_virt_device",
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Function",
"digest": {
"length": 1183.0,
"function_hash": "207534165000877003971568451925149965914"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5aed5b7c2430ce318a8e62f752f181e66f0d1053",
"id": "CVE-2022-50470-d6acf7b8",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"203328417190141024497941210748150554263",
"339737746523717564329574078610209815545",
"258510718839241518633058044527163754500",
"11800172812982025669200662449781229143",
"280978771847100627308153064033943704454",
"338387709850464625672137448469131113033",
"52450109861551699291424720615251692164"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@678d2cc2041cc6ce05030852dce9ad42719abcfc",
"id": "CVE-2022-50470-d9f64d73",
"deprecated": false,
"signature_version": "v1",
"target": {
"function": "xhci_free_virt_device",
"file": "drivers/usb/host/xhci-mem.c"
},
"signature_type": "Function",
"digest": {
"length": 1034.0,
"function_hash": "176819681802167519459735400156032440375"
}
}
]