Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-48857— NFC: port100: fix use-after-free in port100_send_complete

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于NFC:port100模块的port100_send_complete函数中，由于缺少usb_kill_urb函数调用，导致在probe函数的错误处理路径中出现释放后重用问题。

AI Predicted 7.8 Difficulty: Easy EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 0347a6ab300a1532c298823408d6e51ccf4e4f45< 205c4ec78e71cbf561794e6043da80e7bae6790f affected
0347a6ab300a1532c298823408d6e51ccf4e4f45< 32e866ae5a7af590597ef4bcff8451bf96d5f980 affected
0347a6ab300a1532c298823408d6e51ccf4e4f45< b1db33d4e54bc35d8db96ce143ea0ef92e23d58e affected
0347a6ab300a1532c298823408d6e51ccf4e4f45< cd2a5c0da0d1ddf11d1f84e9c9b1949f50f6e161 affected
0347a6ab300a1532c298823408d6e51ccf4e4f45< 2b1c85f56512d49e43bc53741fce2f508cd90029 affected
0347a6ab300a1532c298823408d6e51ccf4e4f45< 0e721b8f2ee5e11376dd55363f9ccb539d754b8a affected
0347a6ab300a1532c298823408d6e51ccf4e4f45< 7194737e1be8fdc89d2a9382bd2f371f7ee2eda8 affected
0347a6ab300a1532c298823408d6e51ccf4e4f45< f80cfe2f26581f188429c12bd937eb905ad3ac7b affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-48857

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NFC: port100: fix use-after-free in port100_send_complete
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe function. port100_send_complete() accesses devm allocated memory which will be freed on probe failure. We should kill this urbs before returning an error from probe function to prevent reported use-after-free Fail log: BUG: KASAN: use-after-free in port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 Read of size 1 at addr ffff88801bb59540 by task ksoftirqd/2/26 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x303 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 port100_send_complete+0x16e/0x1a0 drivers/nfc/port100.c:935 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670 ... Allocated by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:524 alloc_dr drivers/base/devres.c:116 [inline] devm_kmalloc+0x96/0x1d0 drivers/base/devres.c:823 devm_kzalloc include/linux/device.h:209 [inline] port100_probe+0x8a/0x1320 drivers/nfc/port100.c:1502 Freed by task 1255: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0xff/0x140 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] __cache_free mm/slab.c:3437 [inline] kfree+0xf8/0x2b0 mm/slab.c:3794 release_nodes+0x112/0x1a0 drivers/base/devres.c:501 devres_release_all+0x114/0x190 drivers/base/devres.c:530 really_probe+0x626/0xcc0 drivers/base/dd.c:670
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于NFC:port100模块的port100_send_complete函数中，由于缺少usb_kill_urb函数调用，导致在probe函数的错误处理路径中出现释放后重用问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 0347a6ab300a1532c298823408d6e51ccf4e4f45 ~ 205c4ec78e71cbf561794e6043da80e7bae6790f -
Linux Linux 3.13 -

II. Public POCs for CVE-2022-48857

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-48857

请登录查看更多情报信息。

Other References for CVE-2022-48857 (7)

Same Patch Batch · Linux · 2024-07-16 · 98 CVEs total

CVE-2022-48788 9.8 CRITICAL nvme-rdma: fix possible use-after-free in transport error_recovery work
CVE-2022-48789 9.8 CRITICAL nvme-tcp: fix possible use-after-free in transport error_recovery work
CVE-2022-48851 9.8 CRITICAL staging: gdm724x: fix use after free in gdm_lte_rx()
CVE-2022-48790 9.8 CRITICAL nvme: fix a possible use-after-free in controller reset during load
CVE-2022-48829 9.1 CRITICAL NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
CVE-2022-48828 9.1 CRITICAL NFSD: Fix ia_size underflow
CVE-2022-48785 8.8 HIGH ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
CVE-2022-48782 8.8 HIGH mctp: fix use after free
CVE-2022-48830 8.8 HIGH can: isotp: fix potential CAN frame reception race in isotp_rcv()
CVE-2022-48864 8.8 HIGH vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
CVE-2022-48791 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted TMF sas_task
CVE-2022-48792 7.8 HIGH scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
CVE-2022-48847 7.8 HIGH watch_queue: Fix filter limit check
CVE-2022-48839 7.8 HIGH net/packet: fix slab-out-of-bounds access in packet_recvmsg()
CVE-2022-48822 7.8 HIGH usb: f_fs: Fix use-after-free for epfile
CVE-2022-48821 7.8 HIGH misc: fastrpc: avoid double fput() on failed usercopy
CVE-2022-48816 7.8 HIGH SUNRPC: lock against ->sock changing during sysfs read
CVE-2022-48796 7.8 HIGH iommu: Fix potential use-after-free during probe
CVE-2022-48801 7.8 HIGH iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
CVE-2024-41008 7.8 HIGH drm/amdgpu: change vm->task_info handling

Showing top 20 of 98 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-48857

No comments yet

Leave a comment