CVE-2022-50005

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout

When the pn532 uart device is detaching, the pn532_uart_remove()

is called. But there are no functions in pn532_uart_remove() that

could delete the cmd_timeout timer, which will cause use-after-free

bugs. The process is shown below:

(thread 1) | (thread 2)

| pn532_uart_send_frame

pn532_uart_remove | mod_timer(&pn532->cmd_timeout,...)

... | (wait a time)

kfree(pn532) //FREE | pn532_cmd_timeout

| pn532_uart_send_frame

| pn532->... //USE

This patch adds del_timer_sync() in pn532_uart_remove() in order to

prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc()

is well synchronized, it sets nfc_dev->shutting_down to true and there

are no syscal

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References