CVE-2022-50568

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_hid: fix f_hidg lifetime vs cdev

The embedded struct cdev does not have its lifetime correctly tied to

the enclosing struct f_hidg, so there is a use-after-free if /dev/hidgN

is held open while the gadget is deleted.

This can readily be replicated with libusbgx's example programs (for

conciseness - operating directly via configfs is equivalent):

gadget-hid

exec 3<> /dev/hidg0

gadget-vid-pid-remove

exec 3<&-

Pull the existing device up in to struct f_hidg and make use of the

cdev_device_{add,del}() helpers. This changes the lifetime of the

device object to match struct f_hidg, but note that it is still added

and deleted at the same time.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References