CVE-2022-50704

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: Fix use-after-free during usb config switch

In the process of switching USB config from rndis to other config,

if the hardware does not support the ->pullup callback, or the

hardware encounters a low probability fault, both of them may cause

the ->pullup callback to fail, which will then cause a system panic

(use after free).

The gadget drivers sometimes need to be unloaded regardless of the

hardware's behavior.

Analysis as follows:

=======================================================================

(1) write /config/usb_gadget/g1/UDC "none"

gether_disconnect+0x2c/0x1f8

rndis_disable+0x4c/0x74

composite_disconnect+0x74/0xb0

configfs_composite_disconnect+0x60/0x7c

usb_gadget_disconnect+0x70/0x124

usb_gadget_unregister_driver+0xc8/0x1d8

gadget_dev_desc_UDC_store+0xec/0x1e4

(2) rm /config/usb_gadget/g1/configs/b.1/f1

rndis_deregister+0x28/0x54

rndis_free+0x44/0x7c

usb_put_function+0x14/0x1c

config_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References