CVE-2022-50220

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usbnet: Fix linkwatch use-after-free on disconnect

usbnet uses the work usbnet_deferred_kevent() to perform tasks which may

sleep. On disconnect, completion of the work was originally awaited in

->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic

commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":

https://git.kernel.org/tglx/history/c/0f138bbfd83c

The change was made because back then, the kernel's workqueue

implementation did not allow waiting for a single work. One had to wait

for completion of *all* work by calling flush_scheduled_work(), and that

could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex

held in ->ndo_stop().

The commit solved one problem but created another: It causes a

use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c,

ax88179_178a.c, ch9200.c and smsc75xx.c:

* If the drivers receive a link change interrupt immediately before

d

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References