CVE-2022-49059 (GCVE-0-2022-49059)
Vulnerability from cvelistv5
Published
2025-02-26 01:54
Modified
2025-05-04 08:28
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] ================================================================== [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] <TASK> [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] </TASK> [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0x ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1a1748d0dd0f0a98535c6baeef671c8722107639Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5c63ad2b0a267a524c12c88acb1ba9c2d109a801Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/67677050cecbe0edfdd81cd508415e9636ba7c65Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7d3232214ca4ea8f7d18df264c3b254aa8089d7fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9d243aff5f7e6b04e907c617426bbdf26e996ac8Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9ded5ae40f4fe37fcc28f36d76bf45df20be5432Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/edd4600120641e1714e30112e69a548cfb68e067Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ef27324e2cb7bb24542d6cb2571740eefe6b00dcPatch
Impacted products
Vendor Product Version
Linux Linux Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8
Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8
Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8
Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8
Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8
Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8
Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8
Version: 6a2968aaf50c7a22fced77a5e24aa636281efca8
 Create a notification for this product.
   Linux Linux Version: 3.2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49059",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T17:59:20.702464Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:02:30.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7d3232214ca4ea8f7d18df264c3b254aa8089d7f",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "9d243aff5f7e6b04e907c617426bbdf26e996ac8",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "1a1748d0dd0f0a98535c6baeef671c8722107639",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "5c63ad2b0a267a524c12c88acb1ba9c2d109a801",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "67677050cecbe0edfdd81cd508415e9636ba7c65",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "9ded5ae40f4fe37fcc28f36d76bf45df20be5432",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "edd4600120641e1714e30112e69a548cfb68e067",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            },
            {
              "lessThan": "ef27324e2cb7bb24542d6cb2571740eefe6b00dc",
              "status": "affected",
              "version": "6a2968aaf50c7a22fced77a5e24aa636281efca8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/nfc/nci/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.239",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.311",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.239",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.190",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.112",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.35",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.4",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: nci: add flush_workqueue to prevent uaf\n\nOur detector found a concurrent use-after-free bug when detaching an\nNCI device. The main reason for this bug is the unexpected scheduling\nbetween the used delayed mechanism (timer and workqueue).\n\nThe race can be demonstrated below:\n\nThread-1                           Thread-2\n                                 | nci_dev_up()\n                                 |   nci_open_device()\n                                 |     __nci_request(nci_reset_req)\n                                 |       nci_send_cmd\n                                 |         queue_work(cmd_work)\nnci_unregister_device()          |\n  nci_close_device()             | ...\n    del_timer_sync(cmd_timer)[1] |\n...                              | Worker\nnci_free_device()                | nci_cmd_work()\n  kfree(ndev)[3]                 |   mod_timer(cmd_timer)[2]\n\nIn short, the cleanup routine thought that the cmd_timer has already\nbeen detached by [1] but the mod_timer can re-attach the timer [2], even\nit is already released [3], resulting in UAF.\n\nThis UAF is easy to trigger, crash trace by POC is like below\n\n[   66.703713] ==================================================================\n[   66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490\n[   66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33\n[   66.703974]\n[   66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5\n[   66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work\n[   66.703974] Call Trace:\n[   66.703974]  \u003cTASK\u003e\n[   66.703974]  dump_stack_lvl+0x57/0x7d\n[   66.703974]  print_report.cold+0x5e/0x5db\n[   66.703974]  ? enqueue_timer+0x448/0x490\n[   66.703974]  kasan_report+0xbe/0x1c0\n[   66.703974]  ? enqueue_timer+0x448/0x490\n[   66.703974]  enqueue_timer+0x448/0x490\n[   66.703974]  __mod_timer+0x5e6/0xb80\n[   66.703974]  ? mark_held_locks+0x9e/0xe0\n[   66.703974]  ? try_to_del_timer_sync+0xf0/0xf0\n[   66.703974]  ? lockdep_hardirqs_on_prepare+0x17b/0x410\n[   66.703974]  ? queue_work_on+0x61/0x80\n[   66.703974]  ? lockdep_hardirqs_on+0xbf/0x130\n[   66.703974]  process_one_work+0x8bb/0x1510\n[   66.703974]  ? lockdep_hardirqs_on_prepare+0x410/0x410\n[   66.703974]  ? pwq_dec_nr_in_flight+0x230/0x230\n[   66.703974]  ? rwlock_bug.part.0+0x90/0x90\n[   66.703974]  ? _raw_spin_lock_irq+0x41/0x50\n[   66.703974]  worker_thread+0x575/0x1190\n[   66.703974]  ? process_one_work+0x1510/0x1510\n[   66.703974]  kthread+0x2a0/0x340\n[   66.703974]  ? kthread_complete_and_exit+0x20/0x20\n[   66.703974]  ret_from_fork+0x22/0x30\n[   66.703974]  \u003c/TASK\u003e\n[   66.703974]\n[   66.703974] Allocated by task 267:\n[   66.703974]  kasan_save_stack+0x1e/0x40\n[   66.703974]  __kasan_kmalloc+0x81/0xa0\n[   66.703974]  nci_allocate_device+0xd3/0x390\n[   66.703974]  nfcmrvl_nci_register_dev+0x183/0x2c0\n[   66.703974]  nfcmrvl_nci_uart_open+0xf2/0x1dd\n[   66.703974]  nci_uart_tty_ioctl+0x2c3/0x4a0\n[   66.703974]  tty_ioctl+0x764/0x1310\n[   66.703974]  __x64_sys_ioctl+0x122/0x190\n[   66.703974]  do_syscall_64+0x3b/0x90\n[   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   66.703974]\n[   66.703974] Freed by task 406:\n[   66.703974]  kasan_save_stack+0x1e/0x40\n[   66.703974]  kasan_set_track+0x21/0x30\n[   66.703974]  kasan_set_free_info+0x20/0x30\n[   66.703974]  __kasan_slab_free+0x108/0x170\n[   66.703974]  kfree+0xb0/0x330\n[   66.703974]  nfcmrvl_nci_unregister_dev+0x90/0xd0\n[   66.703974]  nci_uart_tty_close+0xdf/0x180\n[   66.703974]  tty_ldisc_kill+0x73/0x110\n[   66.703974]  tty_ldisc_hangup+0x281/0x5b0\n[   66.703974]  __tty_hangup.part.0+0x431/0x890\n[   66.703974]  tty_release+0x3a8/0xc80\n[   66.703974]  __fput+0x1f0/0x8c0\n[   66.703974]  task_work_run+0xc9/0x170\n[   66.703974]  exit_to_user_mode_prepare+0x194/0x1a0\n[   66.703974]  syscall_exit_to_user_mode+0x19/0x50\n[   66.703974]  do_syscall_64+0x48/0x90\n[   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0x\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:28:51.756Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7d3232214ca4ea8f7d18df264c3b254aa8089d7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d243aff5f7e6b04e907c617426bbdf26e996ac8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1a1748d0dd0f0a98535c6baeef671c8722107639"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c63ad2b0a267a524c12c88acb1ba9c2d109a801"
        },
        {
          "url": "https://git.kernel.org/stable/c/67677050cecbe0edfdd81cd508415e9636ba7c65"
        },
        {
          "url": "https://git.kernel.org/stable/c/9ded5ae40f4fe37fcc28f36d76bf45df20be5432"
        },
        {
          "url": "https://git.kernel.org/stable/c/edd4600120641e1714e30112e69a548cfb68e067"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef27324e2cb7bb24542d6cb2571740eefe6b00dc"
        }
      ],
      "title": "nfc: nci: add flush_workqueue to prevent uaf",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49059",
    "datePublished": "2025-02-26T01:54:29.819Z",
    "dateReserved": "2025-02-26T01:49:39.243Z",
    "dateUpdated": "2025-05-04T08:28:51.756Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49059\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:43.150\",\"lastModified\":\"2025-03-24T17:43:25.917\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfc: nci: add flush_workqueue to prevent uaf\\n\\nOur detector found a concurrent use-after-free bug when detaching an\\nNCI device. The main reason for this bug is the unexpected scheduling\\nbetween the used delayed mechanism (timer and workqueue).\\n\\nThe race can be demonstrated below:\\n\\nThread-1                           Thread-2\\n                                 | nci_dev_up()\\n                                 |   nci_open_device()\\n                                 |     __nci_request(nci_reset_req)\\n                                 |       nci_send_cmd\\n                                 |         queue_work(cmd_work)\\nnci_unregister_device()          |\\n  nci_close_device()             | ...\\n    del_timer_sync(cmd_timer)[1] |\\n...                              | Worker\\nnci_free_device()                | nci_cmd_work()\\n  kfree(ndev)[3]                 |   mod_timer(cmd_timer)[2]\\n\\nIn short, the cleanup routine thought that the cmd_timer has already\\nbeen detached by [1] but the mod_timer can re-attach the timer [2], even\\nit is already released [3], resulting in UAF.\\n\\nThis UAF is easy to trigger, crash trace by POC is like below\\n\\n[   66.703713] ==================================================================\\n[   66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490\\n[   66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33\\n[   66.703974]\\n[   66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5\\n[   66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work\\n[   66.703974] Call Trace:\\n[   66.703974]  \u003cTASK\u003e\\n[   66.703974]  dump_stack_lvl+0x57/0x7d\\n[   66.703974]  print_report.cold+0x5e/0x5db\\n[   66.703974]  ? enqueue_timer+0x448/0x490\\n[   66.703974]  kasan_report+0xbe/0x1c0\\n[   66.703974]  ? enqueue_timer+0x448/0x490\\n[   66.703974]  enqueue_timer+0x448/0x490\\n[   66.703974]  __mod_timer+0x5e6/0xb80\\n[   66.703974]  ? mark_held_locks+0x9e/0xe0\\n[   66.703974]  ? try_to_del_timer_sync+0xf0/0xf0\\n[   66.703974]  ? lockdep_hardirqs_on_prepare+0x17b/0x410\\n[   66.703974]  ? queue_work_on+0x61/0x80\\n[   66.703974]  ? lockdep_hardirqs_on+0xbf/0x130\\n[   66.703974]  process_one_work+0x8bb/0x1510\\n[   66.703974]  ? lockdep_hardirqs_on_prepare+0x410/0x410\\n[   66.703974]  ? pwq_dec_nr_in_flight+0x230/0x230\\n[   66.703974]  ? rwlock_bug.part.0+0x90/0x90\\n[   66.703974]  ? _raw_spin_lock_irq+0x41/0x50\\n[   66.703974]  worker_thread+0x575/0x1190\\n[   66.703974]  ? process_one_work+0x1510/0x1510\\n[   66.703974]  kthread+0x2a0/0x340\\n[   66.703974]  ? kthread_complete_and_exit+0x20/0x20\\n[   66.703974]  ret_from_fork+0x22/0x30\\n[   66.703974]  \u003c/TASK\u003e\\n[   66.703974]\\n[   66.703974] Allocated by task 267:\\n[   66.703974]  kasan_save_stack+0x1e/0x40\\n[   66.703974]  __kasan_kmalloc+0x81/0xa0\\n[   66.703974]  nci_allocate_device+0xd3/0x390\\n[   66.703974]  nfcmrvl_nci_register_dev+0x183/0x2c0\\n[   66.703974]  nfcmrvl_nci_uart_open+0xf2/0x1dd\\n[   66.703974]  nci_uart_tty_ioctl+0x2c3/0x4a0\\n[   66.703974]  tty_ioctl+0x764/0x1310\\n[   66.703974]  __x64_sys_ioctl+0x122/0x190\\n[   66.703974]  do_syscall_64+0x3b/0x90\\n[   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0xae\\n[   66.703974]\\n[   66.703974] Freed by task 406:\\n[   66.703974]  kasan_save_stack+0x1e/0x40\\n[   66.703974]  kasan_set_track+0x21/0x30\\n[   66.703974]  kasan_set_free_info+0x20/0x30\\n[   66.703974]  __kasan_slab_free+0x108/0x170\\n[   66.703974]  kfree+0xb0/0x330\\n[   66.703974]  nfcmrvl_nci_unregister_dev+0x90/0xd0\\n[   66.703974]  nci_uart_tty_close+0xdf/0x180\\n[   66.703974]  tty_ldisc_kill+0x73/0x110\\n[   66.703974]  tty_ldisc_hangup+0x281/0x5b0\\n[   66.703974]  __tty_hangup.part.0+0x431/0x890\\n[   66.703974]  tty_release+0x3a8/0xc80\\n[   66.703974]  __fput+0x1f0/0x8c0\\n[   66.703974]  task_work_run+0xc9/0x170\\n[   66.703974]  exit_to_user_mode_prepare+0x194/0x1a0\\n[   66.703974]  syscall_exit_to_user_mode+0x19/0x50\\n[   66.703974]  do_syscall_64+0x48/0x90\\n[   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0x\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: nfc: nci: agregar flush_workqueue para evitar uaf Nuestro detector encontr\u00f3 un error de uso simult\u00e1neo despu\u00e9s de la liberaci\u00f3n al desconectar un dispositivo NCI. La raz\u00f3n principal de este error es la programaci\u00f3n inesperada entre el mecanismo de retraso utilizado (temporizador y cola de trabajo). La ejecuci\u00f3n se puede demostrar a continuaci\u00f3n: Hilo-1 Hilo-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Trabajador nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] En resumen, la rutina de limpieza pens\u00f3 que el cmd_timer ya hab\u00eda sido separado por [1] pero el mod_timer puede volver a unir el temporizador [2], incluso si ya est\u00e1 liberado [3], lo que da como resultado UAF. Este UAF es f\u00e1cil de activar, el seguimiento de fallas por POC es como el siguiente [66.703713] ======================================================================= [66.703974] ERROR: KASAN: use-after-free en enqueue_timer+0x448/0x490 [66.703974] Escritura de tama\u00f1o 8 en la direcci\u00f3n ffff888009fb7058 por la tarea kworker/u4:1/33 [66.703974] [66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 No contaminado 5.18.0-rc2 #5 [ 66.703974] Cola de trabajo: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Rastreo de llamadas: [ 66.703974]  [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974]  [ 66.703974] [ 66.703974] Asignado por la tarea 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] Liberado por la tarea 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0x ---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.2\",\"versionEndExcluding\":\"4.9.311\",\"matchCriteriaId\":\"91A60DD7-6C23-4025-B18F-3CE419A63086\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.14.276\",\"matchCriteriaId\":\"6D9B028C-6313-47F9-94B7-5F8122345E49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.239\",\"matchCriteriaId\":\"712D9B45-4B53-4563-94B5-F758AFBBFB0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.190\",\"matchCriteriaId\":\"E0ADBA6D-47D8-4518-8D10-9B9196DE680B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.112\",\"matchCriteriaId\":\"0460A5D2-3024-497A-B799-23E025B91972\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.35\",\"matchCriteriaId\":\"05ABCC3F-88A9-47F9-9D40-8665747B2E43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.17.4\",\"matchCriteriaId\":\"E22C86CB-06CD-4D16-AB2A-F21EE8199262\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AD94161-84BB-42E6-9882-4FC0C42E9FC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AB06DDF-3C2B-416D-B448-E990D8FF67A9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1a1748d0dd0f0a98535c6baeef671c8722107639\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c63ad2b0a267a524c12c88acb1ba9c2d109a801\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/67677050cecbe0edfdd81cd508415e9636ba7c65\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d3232214ca4ea8f7d18df264c3b254aa8089d7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d243aff5f7e6b04e907c617426bbdf26e996ac8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9ded5ae40f4fe37fcc28f36d76bf45df20be5432\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/edd4600120641e1714e30112e69a548cfb68e067\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef27324e2cb7bb24542d6cb2571740eefe6b00dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49059\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-27T17:59:20.702464Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-27T17:59:22.002Z\"}}], \"cna\": {\"title\": \"nfc: nci: add flush_workqueue to prevent uaf\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"7d3232214ca4ea8f7d18df264c3b254aa8089d7f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"9d243aff5f7e6b04e907c617426bbdf26e996ac8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"1a1748d0dd0f0a98535c6baeef671c8722107639\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"5c63ad2b0a267a524c12c88acb1ba9c2d109a801\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"67677050cecbe0edfdd81cd508415e9636ba7c65\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"9ded5ae40f4fe37fcc28f36d76bf45df20be5432\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"edd4600120641e1714e30112e69a548cfb68e067\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6a2968aaf50c7a22fced77a5e24aa636281efca8\", \"lessThan\": \"ef27324e2cb7bb24542d6cb2571740eefe6b00dc\", \"versionType\": \"git\"}], \"programFiles\": [\"net/nfc/nci/core.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.9.311\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.9.*\"}, {\"status\": \"unaffected\", \"version\": \"4.14.276\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.14.*\"}, {\"status\": \"unaffected\", \"version\": \"4.19.239\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.190\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.112\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.35\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.17.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.17.*\"}, {\"status\": \"unaffected\", \"version\": \"5.18\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/nfc/nci/core.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/7d3232214ca4ea8f7d18df264c3b254aa8089d7f\"}, {\"url\": \"https://git.kernel.org/stable/c/9d243aff5f7e6b04e907c617426bbdf26e996ac8\"}, {\"url\": \"https://git.kernel.org/stable/c/1a1748d0dd0f0a98535c6baeef671c8722107639\"}, {\"url\": \"https://git.kernel.org/stable/c/5c63ad2b0a267a524c12c88acb1ba9c2d109a801\"}, {\"url\": \"https://git.kernel.org/stable/c/67677050cecbe0edfdd81cd508415e9636ba7c65\"}, {\"url\": \"https://git.kernel.org/stable/c/9ded5ae40f4fe37fcc28f36d76bf45df20be5432\"}, {\"url\": \"https://git.kernel.org/stable/c/edd4600120641e1714e30112e69a548cfb68e067\"}, {\"url\": \"https://git.kernel.org/stable/c/ef27324e2cb7bb24542d6cb2571740eefe6b00dc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnfc: nci: add flush_workqueue to prevent uaf\\n\\nOur detector found a concurrent use-after-free bug when detaching an\\nNCI device. The main reason for this bug is the unexpected scheduling\\nbetween the used delayed mechanism (timer and workqueue).\\n\\nThe race can be demonstrated below:\\n\\nThread-1                           Thread-2\\n                                 | nci_dev_up()\\n                                 |   nci_open_device()\\n                                 |     __nci_request(nci_reset_req)\\n                                 |       nci_send_cmd\\n                                 |         queue_work(cmd_work)\\nnci_unregister_device()          |\\n  nci_close_device()             | ...\\n    del_timer_sync(cmd_timer)[1] |\\n...                              | Worker\\nnci_free_device()                | nci_cmd_work()\\n  kfree(ndev)[3]                 |   mod_timer(cmd_timer)[2]\\n\\nIn short, the cleanup routine thought that the cmd_timer has already\\nbeen detached by [1] but the mod_timer can re-attach the timer [2], even\\nit is already released [3], resulting in UAF.\\n\\nThis UAF is easy to trigger, crash trace by POC is like below\\n\\n[   66.703713] ==================================================================\\n[   66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490\\n[   66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:1/33\\n[   66.703974]\\n[   66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5\\n[   66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work\\n[   66.703974] Call Trace:\\n[   66.703974]  \u003cTASK\u003e\\n[   66.703974]  dump_stack_lvl+0x57/0x7d\\n[   66.703974]  print_report.cold+0x5e/0x5db\\n[   66.703974]  ? enqueue_timer+0x448/0x490\\n[   66.703974]  kasan_report+0xbe/0x1c0\\n[   66.703974]  ? enqueue_timer+0x448/0x490\\n[   66.703974]  enqueue_timer+0x448/0x490\\n[   66.703974]  __mod_timer+0x5e6/0xb80\\n[   66.703974]  ? mark_held_locks+0x9e/0xe0\\n[   66.703974]  ? try_to_del_timer_sync+0xf0/0xf0\\n[   66.703974]  ? lockdep_hardirqs_on_prepare+0x17b/0x410\\n[   66.703974]  ? queue_work_on+0x61/0x80\\n[   66.703974]  ? lockdep_hardirqs_on+0xbf/0x130\\n[   66.703974]  process_one_work+0x8bb/0x1510\\n[   66.703974]  ? lockdep_hardirqs_on_prepare+0x410/0x410\\n[   66.703974]  ? pwq_dec_nr_in_flight+0x230/0x230\\n[   66.703974]  ? rwlock_bug.part.0+0x90/0x90\\n[   66.703974]  ? _raw_spin_lock_irq+0x41/0x50\\n[   66.703974]  worker_thread+0x575/0x1190\\n[   66.703974]  ? process_one_work+0x1510/0x1510\\n[   66.703974]  kthread+0x2a0/0x340\\n[   66.703974]  ? kthread_complete_and_exit+0x20/0x20\\n[   66.703974]  ret_from_fork+0x22/0x30\\n[   66.703974]  \u003c/TASK\u003e\\n[   66.703974]\\n[   66.703974] Allocated by task 267:\\n[   66.703974]  kasan_save_stack+0x1e/0x40\\n[   66.703974]  __kasan_kmalloc+0x81/0xa0\\n[   66.703974]  nci_allocate_device+0xd3/0x390\\n[   66.703974]  nfcmrvl_nci_register_dev+0x183/0x2c0\\n[   66.703974]  nfcmrvl_nci_uart_open+0xf2/0x1dd\\n[   66.703974]  nci_uart_tty_ioctl+0x2c3/0x4a0\\n[   66.703974]  tty_ioctl+0x764/0x1310\\n[   66.703974]  __x64_sys_ioctl+0x122/0x190\\n[   66.703974]  do_syscall_64+0x3b/0x90\\n[   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0xae\\n[   66.703974]\\n[   66.703974] Freed by task 406:\\n[   66.703974]  kasan_save_stack+0x1e/0x40\\n[   66.703974]  kasan_set_track+0x21/0x30\\n[   66.703974]  kasan_set_free_info+0x20/0x30\\n[   66.703974]  __kasan_slab_free+0x108/0x170\\n[   66.703974]  kfree+0xb0/0x330\\n[   66.703974]  nfcmrvl_nci_unregister_dev+0x90/0xd0\\n[   66.703974]  nci_uart_tty_close+0xdf/0x180\\n[   66.703974]  tty_ldisc_kill+0x73/0x110\\n[   66.703974]  tty_ldisc_hangup+0x281/0x5b0\\n[   66.703974]  __tty_hangup.part.0+0x431/0x890\\n[   66.703974]  tty_release+0x3a8/0xc80\\n[   66.703974]  __fput+0x1f0/0x8c0\\n[   66.703974]  task_work_run+0xc9/0x170\\n[   66.703974]  exit_to_user_mode_prepare+0x194/0x1a0\\n[   66.703974]  syscall_exit_to_user_mode+0x19/0x50\\n[   66.703974]  do_syscall_64+0x48/0x90\\n[   66.703974]  entry_SYSCALL_64_after_hwframe+0x44/0x\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.9.311\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.14.276\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.239\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.190\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.112\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.35\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.17.4\", \"versionStartIncluding\": \"3.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.18\", \"versionStartIncluding\": \"3.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:28:51.756Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49059\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:28:51.756Z\", \"dateReserved\": \"2025-02-26T01:49:39.243Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-02-26T01:54:29.819Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.