In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: fhid: fix fhidg lifetime vs cdev
The embedded struct cdev does not have its lifetime correctly tied to the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN is held open while the gadget is deleted.
This can readily be replicated with libusbgx's example programs (for conciseness - operating directly via configfs is equivalent):
gadget-hid
exec 3<> /dev/hidg0
gadget-vid-pid-remove
exec 3<&-
Pull the existing device up in to struct fhidg and make use of the cdevdevice{add,del}() helpers. This changes the lifetime of the device object to match struct fhidg, but note that it is still added and deleted at the same time.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50568.json"
}