CVE-2022-50256

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/meson: remove drm bridges at aggregate driver unbind time

drm bridges added by meson_encoder_hdmi_init and meson_encoder_cvbs_init

were not manually removed at module unload time, which caused dangling

references to freed memory to remain linked in the global bridge_list.

When loading the driver modules back in, the same functions would again

call drm_bridge_add, and when traversing the global bridge_list, would

end up peeking into freed memory.

Once again KASAN revealed the problem:

[ +0.000095] =============================================================

[ +0.000008] BUG: KASAN: use-after-free in __list_add_valid+0x9c/0x120

[ +0.000018] Read of size 8 at addr ffff00003da291f0 by task modprobe/2483

[ +0.000018] CPU: 3 PID: 2483 Comm: modprobe Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1

[ +0.000011] Hardware name: Hardkernel ODROID-N2Plus (DT)

[ +0.000008] Call trace:

[ +0.000006] dump_backt

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References