| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-48838: usb: gadget: Fix use-after-free bug by not setting udc->dev.driver |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| usb: gadget: Fix use-after-free bug by not setting udc->dev.driver |
| |
| The syzbot fuzzer found a use-after-free bug: |
| |
| BUG: KASAN: use-after-free in dev_uevent+0x712/0x780 drivers/base/core.c:2320 |
| Read of size 8 at addr ffff88802b934098 by task udevd/3689 |
| |
| CPU: 2 PID: 3689 Comm: udevd Not tainted 5.17.0-rc4-syzkaller-00229-g4f12b742eb2b #0 |
| Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 |
| Call Trace: |
| <TASK> |
| __dump_stack lib/dump_stack.c:88 [inline] |
| dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 |
| print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 |
| __kasan_report mm/kasan/report.c:442 [inline] |
| kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 |
| dev_uevent+0x712/0x780 drivers/base/core.c:2320 |
| uevent_show+0x1b8/0x380 drivers/base/core.c:2391 |
| dev_attr_show+0x4b/0x90 drivers/base/core.c:2094 |
| |
| Although the bug manifested in the driver core, the real cause was a |
| race with the gadget core. dev_uevent() does: |
| |
| if (dev->driver) |
| add_uevent_var(env, "DRIVER=%s", dev->driver->name); |
| |
| and between the test and the dereference of dev->driver, the gadget |
| core sets dev->driver to NULL. |
| |
| The race wouldn't occur if the gadget core registered its devices on |
| a real bus, using the standard synchronization techniques of the |
| driver core. However, it's not necessary to make such a large change |
| in order to fix this bug; all we need to do is make sure that |
| udc->dev.driver is always NULL. |
| |
| In fact, there is no reason for udc->dev.driver ever to be set to |
| anything, let alone to the value it currently gets: the address of the |
| gadget's driver. After all, a gadget driver only knows how to manage |
| a gadget, not how to manage a UDC. |
| |
| This patch simply removes the statements in the gadget core that touch |
| udc->dev.driver. |
| |
| The Linux kernel CVE team has assigned CVE-2022-48838 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 3.1 with commit 2ccea03a8f7ec93641791f2760d7cdc6cab6205f and fixed in 4.9.308 with commit 4325124dde6726267813c736fee61226f1d38f0b |
| Issue introduced in 3.1 with commit 2ccea03a8f7ec93641791f2760d7cdc6cab6205f and fixed in 4.14.273 with commit e2d3a7009e505e120805f449c832942660f3f7f3 |
| Issue introduced in 3.1 with commit 2ccea03a8f7ec93641791f2760d7cdc6cab6205f and fixed in 4.19.236 with commit 609a7119bffe3ddd7c93f2fa65be8917e02a0b7e |
| Issue introduced in 3.1 with commit 2ccea03a8f7ec93641791f2760d7cdc6cab6205f and fixed in 5.4.187 with commit 2282a6eb6d4e118e294e43dcc421e0e0fe4040b5 |
| Issue introduced in 3.1 with commit 2ccea03a8f7ec93641791f2760d7cdc6cab6205f and fixed in 5.10.108 with commit 00bdd9bf1ac6d401ad926d3d8df41b9f1399f646 |
| Issue introduced in 3.1 with commit 2ccea03a8f7ec93641791f2760d7cdc6cab6205f and fixed in 5.15.31 with commit 2015c23610cd0efadaeca4d3a8d1dae9a45aa35a |
| Issue introduced in 3.1 with commit 2ccea03a8f7ec93641791f2760d7cdc6cab6205f and fixed in 5.16.17 with commit 27d64436984fb8835a8b7e95993193cc478b162e |
| Issue introduced in 3.1 with commit 2ccea03a8f7ec93641791f2760d7cdc6cab6205f and fixed in 5.17 with commit 16b1941eac2bd499f065a6739a40ce0011a3d740 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-48838 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/usb/gadget/udc/core.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/4325124dde6726267813c736fee61226f1d38f0b |
| https://git.kernel.org/stable/c/e2d3a7009e505e120805f449c832942660f3f7f3 |
| https://git.kernel.org/stable/c/609a7119bffe3ddd7c93f2fa65be8917e02a0b7e |
| https://git.kernel.org/stable/c/2282a6eb6d4e118e294e43dcc421e0e0fe4040b5 |
| https://git.kernel.org/stable/c/00bdd9bf1ac6d401ad926d3d8df41b9f1399f646 |
| https://git.kernel.org/stable/c/2015c23610cd0efadaeca4d3a8d1dae9a45aa35a |
| https://git.kernel.org/stable/c/27d64436984fb8835a8b7e95993193cc478b162e |
| https://git.kernel.org/stable/c/16b1941eac2bd499f065a6739a40ce0011a3d740 |
