CVE-2022-50542
Description
A use-after-free vulnerability was found in the Linux kernel si470x USB FM radio driver's error handling. A local user with privileges to connect USB devices can physically attach a malicious or malfunctioning si470x USB radio device that triggers initialization failure after USB request submission, causing the driver to free the device structure without canceling pending USB interrupts, which leads to accessing freed memory when the interrupt callback fires and results in memory corruption that can cause denial of service via kernel crash or potentially privilege escalation through heap manipulation.
Statement
The issue arises because of incorrect error handling in the USB device probe sequence. When si470x_usb_driver_probe() calls si470x_start_usb(), the function submits a USB Request Block via usb_submit_urb() and then calls si470x_start() to initialize the device. If si470x_start() fails after successful URB submission, the error handling path in si470x_usb_driver_probe() immediately frees the si470x_device structure without first calling usb_kill_urb() to cancel the pending URB. This creates a window where the URB's completion callback, si470x_int_in_callback(), can fire asynchronously and dereference urb->context, which points to the now-freed si470x_device object. The race window is narrow—the callback must execute between when the structure is freed and when the system reclaims or reuses that memory—justifying high attack complexity. Triggering this requires physical access to connect a USB device and either a genuinely malfunctioning device or a crafted device that causes initialization to fail at the precise point after URB submission. Use-after-free vulnerabilities are well-known memory corruption primitives; with careful heap manipulation and timing, they can enable privilege escalation beyond simple crashes.
Mitigation
To mitigate this issue, prevent the radio_si470x module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.3 | 7.8 | N/A |
| Attack Vector | Physical | Local | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | High | High | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory
If the expired pointer is used in a read operation, an attacker might be able to control data read in by the application.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
If the expired pointer references a memory location that is not accessible to the product, or points to a location that is "malformed" (such as NULL) or larger than expected by a read or write operation, then a crash may occur.
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
If the expired pointer is used in a function call, or points to unexpected data in a write operation, then code execution may be possible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
