CVE-2022-48857

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

NFC: port100: fix use-after-free in port100_send_complete

Syzbot reported UAF in port100_send_complete(). The root case is in

missing usb_kill_urb() calls on error handling path of ->probe function.

port100_send_complete() accesses devm allocated memory which will be

freed on probe failure. We should kill this urbs before returning an

error from probe function to prevent reported use-after-free

Fail log:

BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935

Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26

...

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106

print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255

__kasan_report mm/kasan/report.c:442 [inline]

kasan_report.cold+0x83/0xdf mm/kasan/report.c:459

port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935

__usb_hcd_give

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References