Message-ID: <2025100756-CVE-2022-50542-e0eb@gregkh>
Date: Tue,  7 Oct 2025 17:21:00 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50542: media: si470x: Fix use-after-free in si470x_int_in_callback()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: si470x: Fix use-after-free in si470x_int_in_callback()

syzbot reported use-after-free in si470x_int_in_callback() [1].  This
indicates that urb->context, which contains struct si470x_device
object, is freed when si470x_int_in_callback() is called.

The cause of this issue is that si470x_int_in_callback() is called for
freed urb.

si470x_usb_driver_probe() calls si470x_start_usb(), which then calls
usb_submit_urb() and si470x_start().  If si470x_start_usb() fails,
si470x_usb_driver_probe() doesn't kill urb, but it just frees struct
si470x_device object, as depicted below:

si470x_usb_driver_probe()
  ...
  si470x_start_usb()
    ...
    usb_submit_urb()
    retval = si470x_start()
    return retval
  if (retval < 0)
    free struct si470x_device object, but don't kill urb

This patch fixes this issue by killing urb when si470x_start_usb()
fails and urb is submitted.  If si470x_start_usb() fails and urb is
not submitted, i.e. submitting usb fails, it just frees struct
si470x_device object.

The Linux kernel CVE team has assigned CVE-2022-50542 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.337 with commit 146bd005ebb01ae190c22af050cb98623958c373
	Fixed in 4.14.303 with commit 8c6151b8e8dd2d98ad2cd725d26d1e103d989891
	Fixed in 4.19.270 with commit 52f54fe78cca24850a30865037250f63eb3d5bf7
	Fixed in 5.4.229 with commit 0ca298d548461d29615f9a2b1309e8dcf4a352c6
	Fixed in 5.10.163 with commit 1c6447d0fc68650e51586dde79b5090d9d77f13a
	Fixed in 5.15.86 with commit 6c8aee0c8fcc6dda94315f7908e8fa9bc75abe75
	Fixed in 6.0.16 with commit 63648a7bd1a7599bcc2040a6d1792363ae4c2e1b
	Fixed in 6.1.2 with commit 92b0888398e4ba51d93b618a6506781f4e3879c9
	Fixed in 6.2 with commit 7d21e0b1b41b21d628bf2afce777727bd4479aa5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50542
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/media/radio/si470x/radio-si470x-usb.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/146bd005ebb01ae190c22af050cb98623958c373
	https://git.kernel.org/stable/c/8c6151b8e8dd2d98ad2cd725d26d1e103d989891
	https://git.kernel.org/stable/c/52f54fe78cca24850a30865037250f63eb3d5bf7
	https://git.kernel.org/stable/c/0ca298d548461d29615f9a2b1309e8dcf4a352c6
	https://git.kernel.org/stable/c/1c6447d0fc68650e51586dde79b5090d9d77f13a
	https://git.kernel.org/stable/c/6c8aee0c8fcc6dda94315f7908e8fa9bc75abe75
	https://git.kernel.org/stable/c/63648a7bd1a7599bcc2040a6d1792363ae4c2e1b
	https://git.kernel.org/stable/c/92b0888398e4ba51d93b618a6506781f4e3879c9
	https://git.kernel.org/stable/c/7d21e0b1b41b21d628bf2afce777727bd4479aa5

Powered by blists - more mailing lists