CVE-2022-48822

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: usb: f_fs: Fix use-after-free for epfile Consider a case where ffs_func_eps_disable is called from ffs_func_disable as part of composition switch and at the same time ffs_epfile_release get called from userspace. ffs_epfile_release will free up the read buffer and call ffs_data_closed which in turn destroys ffs->epfiles and mark it as NULL. While this was happening the driver has already initialized the local epfile in ffs_func_eps_disable which is now freed and waiting to acquire the spinlock. Once spinlock is acquired the...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= a9e6f83c2df199187a5248f824f31b6787ae23ae < 32048f4be071f9a6966744243f1786f45bb22dc2, >= a9e6f83c2df199187a5248f824f31b6787ae23ae < cfe5f6fd335d882bcc829a1c8a7d462a455c626e, >= a9e6f83c2df199187a5248f824f31b6787ae23ae < c9fc422c9a43e3d58d246334a71f3390401781dc, >= a9e6f83c2df199187a5248f824f31b6787ae23ae < 0042178a69eb77a979e36a50dcce9794a3140ef8, >= a9e6f83c2df199187a5248f824f31b6787ae23ae < 72a8aee863af099d4434314c4536d6c9a61dcf3c, >= a9e6f83c2df199187a5248f824f31b6787ae23ae < 3e078b18753669615301d946297bafd69294ad2c, >= a9e6f83c2df199187a5248f824f31b6787ae23ae < ebe2b1add1055b903e2acd86b290a85297edc0b3, >= 5cd8f6788ff34999dbd4cbec81a6adfc215e1e60, >= 4.8.10 < 4.9, >= 4.9, >= 4.9 < 4.14.267, >= 4.15 < 4.19.230, >= 4.20 < 5.4.180, >= 5.5 < 5.10.101, >= 5.11 < 5.15.24, >= 5.16 < 5.16.10

Fixed versions

4.14.267, 4.19.230, 5.4.180, 5.10.101, 5.15.24, 5.16.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416