CVE-2023-52907

Wait for out_urb's completion in pn533_usb_send_frame(). Fix a use-after-free that occurs in hcd when in_urb sent from pn533_usb_send_frame() is completed earlier than out_urb. Its callback frees the skb data in pn533_send_async_complete() that is used as a transfer buffer of out_urb. Wait before sending in_urb until the callback of out_urb is called. To modify the callback of out_urb alone, separate the complete function of out_urb and ack_urb.

A moderate-severity use-after-free vulnerability was found in the Linux kernel NFC pn533 USB driver (drivers/nfc/pn533/usb.c). When pn533_usb_send_frame() sends a frame, the in_urb can complete before the out_urb; the in_urb completion callback pn533_send_async_complete() then frees the skb data that is still being used as the transfer buffer of the outstanding out_urb, resulting in a use-after-free in the USB host controller driver. A local user with access to a system using pn533-based USB NFC hardware could exploit this race condition to cause kernel memory corruption, leading to a crash and denial of service. Red Hat rates this flaw as moderate severity (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and specific NFC USB hardware, and the primary consequence is loss of availability; this is lower than the upstream CVE.org rating of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), as there is no evidence that this use-after-free provides confidentiality or integrity impact beyond the availability impact. Based on the current assessment, all products in scope for this flaw — Red Hat Enterprise Linux 6, 7, 8, and 9 kernel and kernel-rt streams, the community projects stream, and the hosted OpenShift (ARO and OSD) streams — are marked not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.