CVE-2022-49755

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait

While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind.

Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.

Fix this by making a serialized execution between the two functions using a mutex_lock(ffs->mutex).

This vulnerability is rated as an Important impact because an authenticated local user could exploit a use-after-free flaw to compromise kernel integrity or cause a system crash. Red Hat Enterprise Linux is not affected by this vulnerability as the affected USB gadget FunctionFS code is not present or enabled in supported enterprise kernels. Furthermore, triggering the condition requires specialized USB device-mode hardware that is typically not present in enterprise server deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.