linux-cve-announce - CVE-2022-50229: ALSA: bcd2000: Fix a UAF bug on the error path of probing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061850-CVE-2022-50229-702e@gregkh>
Date: Wed, 18 Jun 2025 13:04:54 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50229: ALSA: bcd2000: Fix a UAF bug on the error path of probing

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: bcd2000: Fix a UAF bug on the error path of probing

When the driver fails in snd_card_register() at probe time, it will free
the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug.

The following log can reveal it:

[   50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]
[   50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0
[   50.729530] Call Trace:
[   50.732899]  bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]

Fix this by adding usb_kill_urb() before usb_free_urb().

The Linux kernel CVE team has assigned CVE-2022-50229 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 4.9.326 with commit a718eba7e458e2f40531be3c6b6a0028ca7fcace
	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 4.14.291 with commit 4fc41f7ebb7efca282f1740ea934d16f33c1d109
	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 4.19.256 with commit 5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0
	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 5.4.211 with commit 05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24db
	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 5.10.137 with commit 348620464a5c127399ac09b266f494f393661952
	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 5.15.61 with commit 64ca7f50ad96c2c65ae390b954925a36eabe04aa
	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 5.18.18 with commit 1d6a246cf97c380f2da76591f03019dd9c9599c3
	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 5.19.2 with commit b0d4af0a4763ddc02344789ef2a281c494bc330d
	Issue introduced in 3.16 with commit b47a22290d581277be70e8a597824a4985d39e83 and fixed in 6.0 with commit ffb2759df7efbc00187bfd9d1072434a13a54139

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50229
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/usb/bcd2000/bcd2000.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a718eba7e458e2f40531be3c6b6a0028ca7fcace
	https://git.kernel.org/stable/c/4fc41f7ebb7efca282f1740ea934d16f33c1d109
	https://git.kernel.org/stable/c/5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0
	https://git.kernel.org/stable/c/05e0bb8c3c4dde3e21b9c1cf9395afb04e8b24db
	https://git.kernel.org/stable/c/348620464a5c127399ac09b266f494f393661952
	https://git.kernel.org/stable/c/64ca7f50ad96c2c65ae390b954925a36eabe04aa
	https://git.kernel.org/stable/c/1d6a246cf97c380f2da76591f03019dd9c9599c3
	https://git.kernel.org/stable/c/b0d4af0a4763ddc02344789ef2a281c494bc330d
	https://git.kernel.org/stable/c/ffb2759df7efbc00187bfd9d1072434a13a54139