CVE-2022-50005

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout

When the pn532 uart device is detaching, the pn532_uart_remove() is called. But there are no functions in pn532_uart_remove() that could delete the cmd_timeout timer, which will cause use-after-free bugs. The process is shown below:

(thread 1)                  |        (thread 2)
                            |  pn532_uart_send_frame

pn532_uart_remove | mod_timer(&pn532->cmd_timeout,…) … | (wait a time) kfree(pn532) //FREE | pn532_cmd_timeout | pn532_uart_send_frame | pn532->… //USE

This patch adds del_timer_sync() in pn532_uart_remove() in order to prevent the use-after-free bugs. Whats more, the pn53x_unregister_nfc() is well synchronized, it sets nfc_dev->shutting_down to true and there are no syscalls could restart the cmd_timeout timer.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5
• https://git.kernel.org/stable/c/50403ee6daddf0d7a14e9d3b51a377c39a08ec8c
• https://git.kernel.org/stable/c/9c34c33893db7a80d0e4b55c23d3b65e29609cfb
• https://git.kernel.org/stable/c/f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6