CVE-2022-49419

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup

Commit b3c9a924aab6 ("fbdev: vesafb: Cleanup fb_info in .fb_destroy rather

than .remove") fixed a use-after-free error due the vesafb driver freeing

the fb_info in the .remove handler instead of doing it in .fb_destroy.

This can happen if the .fb_destroy callback is executed after the .remove

callback, since the former tries to access a pointer freed by the latter.

But that change didn't take into account that another possible scenario is

that .fb_destroy is called before the .remove callback. For example, if no

process has the fbdev chardev opened by the time the driver is removed.

If that's the case, fb_info will be freed when unregister_framebuffer() is

called, making the fb_info pointer accessed in vesafb_remove() after that

to no longer be valid.

To prevent that, move the expression containing the info->par to happen

before the unregister_f

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References