CVE-2022-50220

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-50220
In the Linux kernel, the following vulnerability has been resolved: usbnet: Fix linkwatch use-after-free on disconnect usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock": https://git.kernel.org/tglx/history/c/0f138bbfd83c The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop(). The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c and smsc75xx.c: * If the drivers receive a link change interrupt immediately before disconnect, they raise EVENT_LINK_RESET in their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent(). * usbnet_deferred_kevent() invokes the driver's ->link_reset() callback, which calls netif_carrier_{on,off}(). * That in turn schedules the work linkwatch_event(). Because usbnet_deferred_kevent() is awaited after unregister_netdev(), netif_carrier_{on,off}() may operate on an unregistered netdev and linkwatch_event() may run after free_netdev(), causing a use-after-free. In 2010, usbnet was changed to only wait for a single instance of usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf ("drivers/net: don't use flush_scheduled_work()"). Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4 Patch
https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4 Patch
https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e Patch
https://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3 Patch
https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74 Patch
https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309 Patch
https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f Patch
https://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f Patch
https://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

19 Nov 2025, 12:59

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usbnet: Se corrige el Use-After-Free de linkwatch al desconectar. usbnet usa la función usbnet_deferred_kevent() para ejecutar tareas que podrían estar en estado de suspensión. Al desconectar, la finalización de la tarea se esperaba originalmente en ->ndo_stop(). Sin embargo, en 2003, esto se trasladó a ->disconnect() mediante el commit histórica "[PATCH] USB: usbnet, previene el bloqueo rtnl exótico": https://git.kernel.org/tglx/history/c/0f138bbfd83c. Este cambio se realizó porque, en aquel entonces, la implementación de la cola de trabajo del kernel no permitía esperar una sola tarea. Se debía esperar la finalización de *todas* las tareas llamando a flush_scheduled_work(), lo que podía provocar un bloqueo al esperar usbnet_deferred_kevent() con rtnl_mutex en ->ndo_stop(). El commit resolvió un problema pero creó otro: Provoca un uso después de la liberación en los controladores Ethernet USB aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c y smsc75xx.c: * Si los controladores reciben una interrupción de cambio de enlace inmediatamente antes de la desconexión, generan EVENT_LINK_RESET en su devolución de llamada ->status() (no inactiva) y programan usbnet_deferred_kevent(). * usbnet_deferred_kevent() invoca la devolución de llamada ->link_reset() del controlador, que llama a netif_carrier_{on,off}(). * Eso a su vez programa el trabajo linkwatch_event(). Dado que usbnet_deferred_kevent() se espera después de unregister_netdev(), netif_carrier_{on,off}() puede operar en un netdev no registrado y linkwatch_event() puede ejecutarse después de free_netdev(), lo que provoca un error de uso después de la liberación. En 2010, se modificó la configuración de usbnet para que solo esperara una instancia de usbnet_deferred_kevent() en lugar de *todo* el trabajo mediante el commit 23f333a2bfaf ("drivers/net: no usar flush_scheduled_work()"). Lamentablemente, el commit no retrasó la espera a ->ndo_stop(). Se corrigió esta omisión de una vez.
References () https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4 - () https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4 - Patch
References () https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4 - () https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4 - Patch
References () https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e - () https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e - Patch
References () https://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3 - () https://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3 - Patch
References () https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74 - () https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74 - Patch
References () https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309 - () https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309 - Patch
References () https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f - () https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f - Patch
References () https://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f - () https://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f - Patch
References () https://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7 - () https://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7 - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-416
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-19 12:59

NVD link : CVE-2022-50220

Mitre link : CVE-2022-50220

CVE.ORG link : CVE-2022-50220

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free