CVE-2022-48857
published 2024-07-16CVE-2022-48857: In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.21%
10.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
NFC: port100: fix use-after-free in port100_send_complete
Syzbot reported UAF in port100_send_complete(). The root case is in
missing usb_kill_urb() calls on error handling path of ->probe function.
port100_send_complete() accesses devm allocated memory which will be
freed on probe failure. We should kill this urbs before returning an
error from probe function to prevent reported use-after-free
Fail log:
BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935
Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26
...
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255
__kasan_report mm/kasan/report.c:442 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
...
Allocated by task 1255:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524
alloc_dr drivers/base/devres.c:116 [inline]
devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823
devm_kzalloc include/linux/device.h:209 [inline]
port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502
Freed by task 1255:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:236 [inline]
__cache_free mm/slab.c:3437 [inline]
kfree+0xf8/0x2b0 mm/slab.c:3794
release_nodes+0x112/0x1a0 drivers/base/devres.c:501
devres_r
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.16.18-1 (bookworm) | linux 5.16.18-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 0347a6ab300a1532c298823408d6e51ccf4e4f45 < 205c4ec78e71cbf561794e6043da80e7bae6790f | 205c4ec78e71cbf561794e6043da80e7bae6790f |
| linux | linux | >= 0347a6ab300a1532c298823408d6e51ccf4e4f45 < 32e866ae5a7af590597ef4bcff8451bf96d5f980 | 32e866ae5a7af590597ef4bcff8451bf96d5f980 |
| linux | linux | >= 0347a6ab300a1532c298823408d6e51ccf4e4f45 < b1db33d4e54bc35d8db96ce143ea0ef92e23d58e | b1db33d4e54bc35d8db96ce143ea0ef92e23d58e |
| linux | linux | >= 0347a6ab300a1532c298823408d6e51ccf4e4f45 < cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161 | cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161 |
| linux | linux | >= 0347a6ab300a1532c298823408d6e51ccf4e4f45 < 2b1c85f56512d49e43bc53741fce2f508cd90029 | 2b1c85f56512d49e43bc53741fce2f508cd90029 |
| linux | linux | >= 0347a6ab300a1532c298823408d6e51ccf4e4f45 < 0e721b8f2ee5e11376dd55363f9ccb539d754b8a | 0e721b8f2ee5e11376dd55363f9ccb539d754b8a |
| linux | linux | >= 0347a6ab300a1532c298823408d6e51ccf4e4f45 < 7194737e1be8fdc89d2a9382bd2f371f7ee2eda8 | 7194737e1be8fdc89d2a9382bd2f371f7ee2eda8 |
| linux | linux | >= 0347a6ab300a1532c298823408d6e51ccf4e4f45 < f80cfe2f26581f188429c12bd937eb905ad3ac7b | f80cfe2f26581f188429c12bd937eb905ad3ac7b |
| linux | linux_kernel | >= 0 < 5.10.106-1 | 5.10.106-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 5.16.18-1 | 5.16.18-1 |
| linux | linux_kernel | >= 0 < 4.4.0-259.293 | 4.4.0-259.293 |
| linux | linux_kernel | >= 3.13 < 4.9.307 | 4.9.307 |
| linux | linux_kernel | >= 4.10 < 4.14.272 | 4.14.272 |
| linux | linux_kernel | >= 4.15 < 4.19.235 | 4.19.235 |
| linux | linux_kernel | >= 4.20 < 5.4.185 | 5.4.185 |
| linux | linux_kernel | >= 5.11 < 5.15.29 | 5.15.29 |
| linux | linux_kernel | >= 5.16 < 5.16.15 | 5.16.15 |
| linux | linux_kernel | >= 5.5 < 5.10.106 | 5.10.106 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2024-09-26·CVSS 5.5
[MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Input Device (Tablet) drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- Near Field Communication (NFC) drivers;
- SCSI drivers;
- GCT GDM724x LTE driver;
- USB subsystem;
- VFIO drivers;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Networking core;
- IPv4 networking;
- L2TP protocol;
- Netfilter;
- RxRPC session sockets;
(CVE-2024-26651, CVE-2024-38583, CVE-2023-52527, CVE-2024-26880,
CVE-2022-48850, CVE-2024-26733, CVE-2021-47188, CVE-2024-42154,
CVE-2023-52809, CVE-2024-42228, CVE-2022
GHSA
GHSA-wrch-9585-fw25: In the Linux kernel, the following vulnerability has been resolved:
NFC: port100: fix use-after-free in port100_send_complete
Syzbot reported UAF in
ghsa_unreviewed·2024-07-16
CVE-2022-48857 [MEDIUM] CWE-416 GHSA-wrch-9585-fw25: In the Linux kernel, the following vulnerability has been resolved:
NFC: port100: fix use-after-free in port100_send_complete
Syzbot reported UAF in
In the Linux kernel, the following vulnerability has been resolved:
NFC: port100: fix use-after-free in port100_send_complete
Syzbot reported UAF in port100_send_complete(). The root case is in
missing usb_kill_urb() calls on error handling path of ->probe function.
port100_send_complete() accesses devm allocated memory which will be
freed on probe failure. We should kill this urbs before returning an
error from probe function to prevent reported use-after-free
Fail log:
BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935
Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26
...
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x303 mm/kas
OSV
CVE-2022-48857: In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in p
osv·2024-07-16·CVSS 5.5
CVE-2022-48857 [MEDIUM] CVE-2022-48857: In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in p
In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_send_complete() accesses devm allocated memory which will be freed on probe failure. We should kill this urbs before returning an error from probe function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 ... Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/rep
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-09-26·CVSS 5.5
CVE-2021-47188 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- Input Device (Tablet) drivers;
- Modular ISDN driver;
- Multiple devices driver;
- Network drivers;
- Near Field Communication (NFC) drivers;
- SCSI drivers;
- GCT GDM724x LTE driver;
- USB subsystem;
- VFIO drivers;
- GFS2 file system;
- JFS file system;
- NILFS2 file system;
- Networking core;
- IPv4 networking;
- L2TP protocol;
- Netfilter;
- RxRPC session sockets;
(CVE-2024-26651, CVE-2024-38583, CVE-2023-52527, CVE-2024-26880,
CVE-2022-48850, CVE-2024-26733, CVE-2021-47188, CVE-2024-42154,
Red Hat
kernel: NFC: port100: fix use-after-free in port100_send_complete
vendor_redhat·2024-07-16·CVSS 5.5
CVE-2022-48857 [MEDIUM] CWE-416 kernel: NFC: port100: fix use-after-free in port100_send_complete
kernel: NFC: port100: fix use-after-free in port100_send_complete
In the Linux kernel, the following vulnerability has been resolved:
NFC: port100: fix use-after-free in port100_send_complete
Syzbot reported UAF in port100_send_complete(). The root case is in
missing usb_kill_urb() calls on error handling path of ->probe function.
port100_send_complete() accesses devm allocated memory which will be
freed on probe failure. We should kill this urbs before returning an
error from probe function to prevent reported use-after-free
Fail log:
BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935
Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26
...
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:10
Debian
CVE-2022-48857: linux - In the Linux kernel, the following vulnerability has been resolved: NFC: port10...
vendor_debian·2022·CVSS 5.5
CVE-2022-48857 [MEDIUM] CVE-2022-48857: linux - In the Linux kernel, the following vulnerability has been resolved: NFC: port10...
In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_send_complete() accesses devm allocated memory which will be freed on probe failure. We should kill this urbs before returning an error from probe function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 ... Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/rep
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/0e721b8f2ee5e11376dd55363f9ccb539d754b8ahttps://git.kernel.org/stable/c/205c4ec78e71cbf561794e6043da80e7bae6790fhttps://git.kernel.org/stable/c/2b1c85f56512d49e43bc53741fce2f508cd90029https://git.kernel.org/stable/c/32e866ae5a7af590597ef4bcff8451bf96d5f980https://git.kernel.org/stable/c/7194737e1be8fdc89d2a9382bd2f371f7ee2eda8https://git.kernel.org/stable/c/b1db33d4e54bc35d8db96ce143ea0ef92e23d58ehttps://git.kernel.org/stable/c/cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161https://git.kernel.org/stable/c/f80cfe2f26581f188429c12bd937eb905ad3ac7bhttps://git.kernel.org/stable/c/0e721b8f2ee5e11376dd55363f9ccb539d754b8ahttps://git.kernel.org/stable/c/205c4ec78e71cbf561794e6043da80e7bae6790fhttps://git.kernel.org/stable/c/2b1c85f56512d49e43bc53741fce2f508cd90029https://git.kernel.org/stable/c/32e866ae5a7af590597ef4bcff8451bf96d5f980https://git.kernel.org/stable/c/7194737e1be8fdc89d2a9382bd2f371f7ee2eda8https://git.kernel.org/stable/c/b1db33d4e54bc35d8db96ce143ea0ef92e23d58ehttps://git.kernel.org/stable/c/cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161https://git.kernel.org/stable/c/f80cfe2f26581f188429c12bd937eb905ad3ac7b
2024-07-16
Published