CVE-2022-50560

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

drm/meson: explicitly remove aggregate driver at module unload time

Because component_master_del wasn't being called when unloading the

meson_drm module, the aggregate device would linger forever in the global

aggregate_devices list. That means when unloading and reloading the

meson_dw_hdmi module, component_add would call into

try_to_bring_up_aggregate_device and find the unbound meson_drm aggregate

device.

This would in turn dereference some of the aggregate_device's struct

entries which point to memory automatically freed by the devres API when

unbinding the aggregate device from meson_drv_unbind, and trigger an

use-after-free bug:

[ +0.000014] =============================================================

[ +0.000007] BUG: KASAN: use-after-free in find_components+0x468/0x500

[ +0.000017] Read of size 8 at addr ffff000006731688 by task modprobe/2536

[ +0.000018] CPU: 4 PID: 2536 Comm: modprobe Tainted: G

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References