Message-ID: <2025061847-CVE-2022-50220-8682@gregkh>
Date: Wed, 18 Jun 2025 13:04:45 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50220: usbnet: Fix linkwatch use-after-free on disconnect

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usbnet: Fix linkwatch use-after-free on disconnect

usbnet uses the work usbnet_deferred_kevent() to perform tasks which may
sleep.  On disconnect, completion of the work was originally awaited in
->ndo_stop().  But in 2003, that was moved to ->disconnect() by historic
commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":

  https://git.kernel.org/tglx/history/c/0f138bbfd83c

The change was made because back then, the kernel's workqueue
implementation did not allow waiting for a single work.  One had to wait
for completion of *all* work by calling flush_scheduled_work(), and that
could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex
held in ->ndo_stop().

The commit solved one problem but created another:  It causes a
use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c,
ax88179_178a.c, ch9200.c and smsc75xx.c:

* If the drivers receive a link change interrupt immediately before
  disconnect, they raise EVENT_LINK_RESET in their (non-sleepable)
  ->status() callback and schedule usbnet_deferred_kevent().
* usbnet_deferred_kevent() invokes the driver's ->link_reset() callback,
  which calls netif_carrier_{on,off}().
* That in turn schedules the work linkwatch_event().

Because usbnet_deferred_kevent() is awaited after unregister_netdev(),
netif_carrier_{on,off}() may operate on an unregistered netdev and
linkwatch_event() may run after free_netdev(), causing a use-after-free.

In 2010, usbnet was changed to only wait for a single instance of
usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf
("drivers/net: don't use flush_scheduled_work()").

Unfortunately the commit neglected to move the wait back to
->ndo_stop().  Rectify that omission at long last.

The Linux kernel CVE team has assigned CVE-2022-50220 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.326 with commit d2d6b530d89b0a912148018027386aa049f0a309
	Fixed in 4.14.291 with commit e2a521a7dcc463c5017b4426ca0804e151faeff7
	Fixed in 4.19.256 with commit 7f77dcbc030c2faa6d8e8a594985eeb34018409e
	Fixed in 5.4.211 with commit 8b4588b8b00b299be16a35be67b331d8fdba03f3
	Fixed in 5.10.137 with commit 135199a2edd459d2b123144efcd7f9bcd95128e4
	Fixed in 5.15.61 with commit 635fd8953e4309b54ca6a81bed1d4a87668694f4
	Fixed in 5.18.18 with commit d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f
	Fixed in 5.19.2 with commit db3b738ae5f726204876f4303c49cfdf4311403f
	Fixed in 6.0 with commit a69e617e533edddf3fa3123149900f36e0a6dc74

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50220
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/usb/usbnet.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d2d6b530d89b0a912148018027386aa049f0a309
	https://git.kernel.org/stable/c/e2a521a7dcc463c5017b4426ca0804e151faeff7
	https://git.kernel.org/stable/c/7f77dcbc030c2faa6d8e8a594985eeb34018409e
	https://git.kernel.org/stable/c/8b4588b8b00b299be16a35be67b331d8fdba03f3
	https://git.kernel.org/stable/c/135199a2edd459d2b123144efcd7f9bcd95128e4
	https://git.kernel.org/stable/c/635fd8953e4309b54ca6a81bed1d4a87668694f4
	https://git.kernel.org/stable/c/d49bb8cf9bfaa06aa527eb30f1a52a071da2e32f
	https://git.kernel.org/stable/c/db3b738ae5f726204876f4303c49cfdf4311403f
	https://git.kernel.org/stable/c/a69e617e533edddf3fa3123149900f36e0a6dc74

Powered by blists - more mailing lists