CVE-2022-50005

In the Linux kernel, the following vulnerability has been resolved:

nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout

When the pn532 uart device is detaching, the pn532_uart_remove() is called. But there are no functions in pn532_uart_remove() that could delete the cmd_timeout timer, which will cause use-after-free bugs. The process is shown below:

(thread 1)                  |        (thread 2)
                            |  pn532_uart_send_frame

pn532_uart_remove | mod_timer(&pn532->cmd_timeout,...) ... | (wait a time) kfree(pn532) //FREE | pn532_cmd_timeout | pn532_uart_send_frame | pn532->... //USE

This patch adds del_timer_sync() in pn532_uart_remove() in order to prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc() is well synchronized, it sets nfc_dev->shutting_down to true and there are no syscalls could restart the cmd_timeout timer.

This vulnerability is rated as Moderate impact because successful exploitation requires local access and the detachment of specific physical or emulated PN532 NFC hardware, limiting the attack surface in standard enterprise environments. A timing window during device removal allows an active timer callback to access deallocated memory structures after teardown, potentially leading to a kernel crash or privilege escalation. Because NFC devices are not typically attached or configured on production servers, general risk across enterprise workloads is substantially reduced.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.