CVE-2022-48760

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

USB: core: Fix hang in usb_kill_urb by adding memory barriers

The syzbot fuzzer has identified a bug in which processes hang waiting

for usb_kill_urb() to return. It turns out the issue is not unlinking

the URB; that works just fine. Rather, the problem arises when the

wakeup notification that the URB has completed is not received.

The reason is memory-access ordering on SMP systems. In outline form,

usb_kill_urb() and __usb_hcd_giveback_urb() operating concurrently on

different CPUs perform the following actions:

CPU 0 CPU 1

---------------------------- ---------------------------------

usb_kill_urb(): __usb_hcd_giveback_urb():

... ...

atomic_inc(&urb->reject); atomic_dec(&urb->use_count);

... ...

wait_event(usb_kill_urb_queue,

atomic_read(&urb->use_count) == 0);

if (atomic_read(&urb->reject))

wake_up(&usb_kill_urb_queue);

Confining your attention to urb->reject and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References