CVE-2022-48857

NFC: port100: fix use-after-free in port100_send_complete

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

NFC: port100: fix use-after-free in port100_send_complete

Syzbot reported UAF in port100_send_complete(). The root case is in
missing usb_kill_urb() calls on error handling path of ->probe function.

port100_send_complete() accesses devm allocated memory which will be
freed on probe failure. We should kill this urbs before returning an
error from probe function to prevent reported use-after-free

Fail log:

BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935
Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26
...
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255
__kasan_report mm/kasan/report.c:442 [inline]
kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935
__usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670

...

Allocated by task 1255:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
____kasan_kmalloc mm/kasan/common.c:515 [inline]
____kasan_kmalloc mm/kasan/common.c:474 [inline]
__kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524
alloc_dr drivers/base/devres.c:116 [inline]
devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823
devm_kzalloc include/linux/device.h:209 [inline]
port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502

Freed by task 1255:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track+0x21/0x30 mm/kasan/common.c:45
kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
____kasan_slab_free mm/kasan/common.c:366 [inline]
____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328
kasan_slab_free include/linux/kasan.h:236 [inline]
__cache_free mm/slab.c:3437 [inline]
kfree+0xf8/0x2b0 mm/slab.c:3794
release_nodes+0x112/0x1a0 drivers/base/devres.c:501
devres_release_all+0x114/0x190 drivers/base/devres.c:530
really_probe+0x626/0xcc0 drivers/base/dd.c:670

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: NFC: puerto100: corrige use-after-free en port100_send_complete Syzbot informó UAF en port100_send_complete(). El caso raíz es que faltan llamadas usb_kill_urb() en la ruta de manejo de errores de ->función de sonda. port100_send_complete() accede a la memoria asignada por el desarrollador que se liberará en caso de falla de la sonda. Deberíamos eliminar estas urbs antes de devolver un error de la función de sonda para evitar el registro de errores de use-after-free: ERROR: KASAN: use-after-free en port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Lectura de tamaño 1 en addr ffff88801bb59540 por tarea ksoftirqd/2/26... Seguimiento de llamadas: __dump_stack lib/dump_stack.c:88 [en línea] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold +0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [en línea] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 port100_send_complete+0x16e/0x1a0 controladores/nfc /port100.c:935 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670 ... Asignado por tarea 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common .c:45 [en línea] set_alloc_info mm/kasan/common.c:436 [en línea] ____kasan_kmalloc mm/kasan/common.c:515 [en línea] ____kasan_kmalloc mm/kasan/common.c:474 [en línea] __kasan_kmalloc+0xa6/ 0xd0 mm/kasan/common.c:524 alloc_dr drivers/base/devres.c:116 [en línea] devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823 devm_kzalloc include/linux/device.h:209 [en línea] port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502 Liberado por la tarea 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20 /0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [en línea] ____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [en línea ] __cache_free mm/slab.c:3437 [en línea] kfree+0xf8/0x2b0 mm/slab.c:3794 release_nodes+0x112/0x1a0 drivers/base/devres.c:501 devres_release_all+0x114/0x190 drivers/base/devres.c :530 realmente_probe+0x626/0xcc0 controladores/base/dd.c:670

*Credits: N/A

CVSS Scores

NISTv3.1 5.5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-07-16 CVE Reserved
2024-07-16 CVE Published
2024-07-24 EPSS Updated
2024-11-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-416: Use After Free

CAPEC

References (9)

URL	Tag	Source
https://git.kernel.org/stable/c/0347a6ab300a1532c298823408d6e51ccf4e4f45	Vuln. Introduced

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/205c4ec78e71cbf561794e6043da80e7bae6790f	2022-03-16
https://git.kernel.org/stable/c/32e866ae5a7af590597ef4bcff8451bf96d5f980	2022-03-16
https://git.kernel.org/stable/c/b1db33d4e54bc35d8db96ce143ea0ef92e23d58e	2022-03-16
https://git.kernel.org/stable/c/cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161	2022-03-16
https://git.kernel.org/stable/c/2b1c85f56512d49e43bc53741fce2f508cd90029	2022-03-16
https://git.kernel.org/stable/c/0e721b8f2ee5e11376dd55363f9ccb539d754b8a	2022-03-16
https://git.kernel.org/stable/c/7194737e1be8fdc89d2a9382bd2f371f7ee2eda8	2022-03-16
https://git.kernel.org/stable/c/f80cfe2f26581f188429c12bd937eb905ad3ac7b	2022-03-10

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.13 < 4.9.307 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 4.9.307"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.13 < 4.14.272 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 4.14.272"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.13 < 4.19.235 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 4.19.235"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.13 < 5.4.185 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 5.4.185"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.13 < 5.10.106 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 5.10.106"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.13 < 5.15.29 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 5.15.29"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.13 < 5.16.15 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 5.16.15"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 3.13 < 5.17 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.13 < 5.17"		en		Affected