CVE-2022-50542

A use-after-free vulnerability was found in the Linux kernel si470x USB FM radio driver's error handling. A local user with privileges to connect USB devices can physically attach a malicious or malfunctioning si470x USB radio device that triggers initialization failure after USB request submission, causing the driver to free the device structure without canceling pending USB interrupts, which leads to accessing freed memory when the interrupt callback fires and results in memory corruption that can cause denial of service via kernel crash or potentially privilege escalation through heap manipulation.

The issue arises because of incorrect error handling in the USB device probe sequence. When si470x_usb_driver_probe() calls si470x_start_usb(), the function submits a USB Request Block via usb_submit_urb() and then calls si470x_start() to initialize the device. If si470x_start() fails after successful URB submission, the error handling path in si470x_usb_driver_probe() immediately frees the si470x_device structure without first calling usb_kill_urb() to cancel the pending URB. This creates a window where the URB's completion callback, si470x_int_in_callback(), can fire asynchronously and dereference urb->context, which points to the now-freed si470x_device object. The race window is narrow—the callback must execute between when the structure is freed and when the system reclaims or reuses that memory—justifying high attack complexity. Triggering this requires physical access to connect a USB device and either a genuinely malfunctioning device or a crafted device that causes initialization to fail at the precise point after URB submission. Use-after-free vulnerabilities are well-known memory corruption primitives; with careful heap manipulation and timing, they can enable privilege escalation beyond simple crashes.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the radio_si470x module from loading. See https://access.redhat.com/solutions/41278 for instructions on blacklisting kernel modules.