CVE-2022-49059
published 2025-02-26CVE-2022-49059: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-after-free…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.30%
22.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: add flush_workqueue to prevent uaf
Our detector found a concurrent use-after-free bug when detaching an
NCI device. The main reason for this bug is the unexpected scheduling
between the used delayed mechanism (timer and workqueue).
The race can be demonstrated below:
Thread-1 Thread-2
| nci_dev_up()
| nci_open_device()
| __nci_request(nci_reset_req)
| nci_send_cmd
| queue_work(cmd_work)
nci_unregister_device() |
nci_close_device() | ...
del_timer_sync(cmd_timer)[1] |
... | Worker
nci_free_device() | nci_cmd_work()
kfree(ndev)[3] | mod_timer(cmd_timer)[2]
In short, the cleanup routine thought that the cmd_timer has already
been detached by [1] but the mod_timer can re-attach the timer [2], even
it is already released [3], resulting in UAF.
This UAF is easy to trigger, crash trace by POC is like below
[ 66.703713] ==================================================================
[ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490
[ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33
[ 66.703974]
[ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5
[ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work
[ 66.703974] Call Trace:
[ 66.703974]
[ 66.703974] dump_stack_lvl+0x57/0x7d
[ 66.703974] print_report.cold+0x5e/0x5db
[ 66.703974] ? enqueue_timer+0x448/0x490
[ 66.703974] kasan_report+0xbe/0x1c0
[ 66.703974] ? enqueue_timer+0x448/0x490
[ 66.703974] enqueue_timer+0x448/0x490
[ 66.703974] __mod_timer+0x5e6/0xb80
[ 66.703974] ? mark_held_locks+0x9e/0xe0
[ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0
[ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410
[ 66.703974] ? queue_work_on+0x61/0x80
[ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130
[ 66.703974] process_one_work+0x8bb/0x1510
[ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410
[ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230
[ 66.703974] ? rwlock_bug.part.0+0x90/0x90
[ 66.703
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.6-1 (bookworm) | linux 5.17.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 6a2968aaf50c7a22fced77a5e24aa636281efca8 < 7d3232214ca4ea8f7d18df264c3b254aa8089d7f | 7d3232214ca4ea8f7d18df264c3b254aa8089d7f |
| linux | linux | >= 6a2968aaf50c7a22fced77a5e24aa636281efca8 < 9d243aff5f7e6b04e907c617426bbdf26e996ac8 | 9d243aff5f7e6b04e907c617426bbdf26e996ac8 |
| linux | linux | >= 6a2968aaf50c7a22fced77a5e24aa636281efca8 < 1a1748d0dd0f0a98535c6baeef671c8722107639 | 1a1748d0dd0f0a98535c6baeef671c8722107639 |
| linux | linux | >= 6a2968aaf50c7a22fced77a5e24aa636281efca8 < 5c63ad2b0a267a524c12c88acb1ba9c2d109a801 | 5c63ad2b0a267a524c12c88acb1ba9c2d109a801 |
| linux | linux | >= 6a2968aaf50c7a22fced77a5e24aa636281efca8 < 67677050cecbe0edfdd81cd508415e9636ba7c65 | 67677050cecbe0edfdd81cd508415e9636ba7c65 |
| linux | linux | >= 6a2968aaf50c7a22fced77a5e24aa636281efca8 < 9ded5ae40f4fe37fcc28f36d76bf45df20be5432 | 9ded5ae40f4fe37fcc28f36d76bf45df20be5432 |
| linux | linux | >= 6a2968aaf50c7a22fced77a5e24aa636281efca8 < edd4600120641e1714e30112e69a548cfb68e067 | edd4600120641e1714e30112e69a548cfb68e067 |
| linux | linux | >= 6a2968aaf50c7a22fced77a5e24aa636281efca8 < ef27324e2cb7bb24542d6cb2571740eefe6b00dc | ef27324e2cb7bb24542d6cb2571740eefe6b00dc |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.113-1 | 5.10.113-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 3.2 < 4.9.311 | 4.9.311 |
| linux | linux_kernel | >= 4.10 < 4.14.276 | 4.14.276 |
| linux | linux_kernel | >= 4.15 < 4.19.239 | 4.19.239 |
| linux | linux_kernel | >= 4.20 < 5.4.190 | 5.4.190 |
| linux | linux_kernel | >= 5.11 < 5.15.35 | 5.15.35 |
| linux | linux_kernel | >= 5.16 < 5.17.4 | 5.17.4 |
| linux | linux_kernel | >= 5.5 < 5.10.112 | 5.10.112 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p967-4mgh-r94w: In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: add flush_workqueue to prevent uaf
Our detector found a concurrent use
ghsa_unreviewed·2025-02-27
CVE-2022-49059 [HIGH] CWE-416 GHSA-p967-4mgh-r94w: In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: add flush_workqueue to prevent uaf
Our detector found a concurrent use
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: add flush_workqueue to prevent uaf
Our detector found a concurrent use-after-free bug when detaching an
NCI device. The main reason for this bug is the unexpected scheduling
between the used delayed mechanism (timer and workqueue).
The race can be demonstrated below:
Thread-1 Thread-2
| nci_dev_up()
| nci_open_device()
| __nci_request(nci_reset_req)
| nci_send_cmd
| queue_work(cmd_work)
nci_unregister_device() |
nci_close_device() | ...
del_timer_sync(cmd_timer)[1] |
... | Worker
nci_free_device() | nci_cmd_work()
kfree(ndev)[3] | mod_timer(cmd_timer)[2]
In short, the cleanup routine thought that the cmd_timer has already
been detached by [1] but the mod_timer can re-attach the timer [2], even
it is already
OSV
CVE-2022-49059: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-a
osv·2025-02-26·CVSS 7.8
CVE-2022-49059 [HIGH] CVE-2022-49059: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-a
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already relea
Red Hat
kernel: nfc: nci: add flush_workqueue to prevent uaf
vendor_redhat·2025-02-26·CVSS 7.8
CVE-2022-49059 [HIGH] CWE-416 kernel: nfc: nci: add flush_workqueue to prevent uaf
kernel: nfc: nci: add flush_workqueue to prevent uaf
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: add flush_workqueue to prevent uaf
Our detector found a concurrent use-after-free bug when detaching an
NCI device. The main reason for this bug is the unexpected scheduling
between the used delayed mechanism (timer and workqueue).
The race can be demonstrated below:
Thread-1 Thread-2
| nci_dev_up()
| nci_open_device()
| __nci_request(nci_reset_req)
| nci_send_cmd
| queue_work(cmd_work)
nci_unregister_device() |
nci_close_device() | ...
del_timer_sync(cmd_timer)[1] |
... | Worker
nci_free_device() | nci_cmd_work()
kfree(ndev)[3] | mod_timer(cmd_timer)[2]
In short, the cleanup routine thought that the cmd_timer has already
been detached by [1] but the mod_timer
Debian
CVE-2022-49059: linux - In the Linux kernel, the following vulnerability has been resolved: nfc: nci: a...
vendor_debian·2022·CVSS 7.8
CVE-2022-49059 [HIGH] CVE-2022-49059: linux - In the Linux kernel, the following vulnerability has been resolved: nfc: nci: a...
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already relea
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/1a1748d0dd0f0a98535c6baeef671c8722107639https://git.kernel.org/stable/c/5c63ad2b0a267a524c12c88acb1ba9c2d109a801https://git.kernel.org/stable/c/67677050cecbe0edfdd81cd508415e9636ba7c65https://git.kernel.org/stable/c/7d3232214ca4ea8f7d18df264c3b254aa8089d7fhttps://git.kernel.org/stable/c/9d243aff5f7e6b04e907c617426bbdf26e996ac8https://git.kernel.org/stable/c/9ded5ae40f4fe37fcc28f36d76bf45df20be5432https://git.kernel.org/stable/c/edd4600120641e1714e30112e69a548cfb68e067https://git.kernel.org/stable/c/ef27324e2cb7bb24542d6cb2571740eefe6b00dc
2025-02-26
Published