linux-cve-announce - CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022634-CVE-2022-49729-4536@gregkh>
Date: Wed, 26 Feb 2025 03:24:52 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49729: nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred

Similar to the handling of play_deferred in commit 19cfe912c37b
("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought
a patch might be needed here as well.

Currently usb_submit_urb is called directly to submit deferred tx
urbs after unanchor them.

So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb
and cause memory leak.

Put those urbs in tx_anchor to avoid the leak, and also fix the error
handling.

The Linux kernel CVE team has assigned CVE-2022-49729 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.320 with commit 1eb0afecfb9cd0f38424b82bd9aaa542310934ee
	Fixed in 4.14.285 with commit f21f908347712b8288ffe83b531b5e977042b29c
	Fixed in 4.19.249 with commit 3e7c7df6991ac349f2fa8540047757df666e610f
	Fixed in 5.4.200 with commit 6b4d8b44e7163a77fe942f5b80e1651c1b78c537
	Fixed in 5.10.124 with commit 0eeec1a8b0cd38c47edeb042980a6aeacecf35ed
	Fixed in 5.15.49 with commit 6616872cfe7f0474a22dd1f12699f95bcf81a54d
	Fixed in 5.18.6 with commit 3eadc560c1919b8193d17334145dad9a917960e4
	Fixed in 5.19 with commit 8a4d480702b71184fabcf379b80bf7539716752e

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49729
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/nfc/nfcmrvl/usb.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1eb0afecfb9cd0f38424b82bd9aaa542310934ee
	https://git.kernel.org/stable/c/f21f908347712b8288ffe83b531b5e977042b29c
	https://git.kernel.org/stable/c/3e7c7df6991ac349f2fa8540047757df666e610f
	https://git.kernel.org/stable/c/6b4d8b44e7163a77fe942f5b80e1651c1b78c537
	https://git.kernel.org/stable/c/0eeec1a8b0cd38c47edeb042980a6aeacecf35ed
	https://git.kernel.org/stable/c/6616872cfe7f0474a22dd1f12699f95bcf81a54d
	https://git.kernel.org/stable/c/3eadc560c1919b8193d17334145dad9a917960e4
	https://git.kernel.org/stable/c/8a4d480702b71184fabcf379b80bf7539716752e