CVE-2022-49501
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: usbnet: Run unregister_netdev() before unbind() again Commit 2c9d6c2b871d ("usbnet: run unbind() before unregister_netdev()") sought to fix a use-after-free on disconnect of USB Ethernet adapters. It turns out that a different fix is necessary to address the issue: https://lore.kernel.org/netdev/18b3541e5372bc9b9fc733d422f4e698c089077c.1650177997.git.lukas@wunner.de/ So the commit was not necessary. The commit made binding and unbinding of USB Ethernet asymmetrical: Before, usbnet_probe() first invoked the ->bind() callback and then register_netdev(). usbnet_disconnect() mirrored that by first invoking unregister_netdev() and then ->unbind(). Since the commit, the order in usbnet_disconnect() is reversed and no longer mirrors usbnet_probe(). One consequence is that a PHY disconnected (and stopped) in ->unbind() is afterwards stopped once more by unregister_netdev() as it closes the netdev before unregistering. That necessitates a contortion in ->stop() because the PHY may only be stopped if it hasn't already been disconnected. Reverting the commit allows making the call to phy_stop() unconditional in ->stop().
Security Summary
CVE-2022-49501 is a use-after-free vulnerability in the Linux kernel's usbnet driver, affecting USB Ethernet adapters. A prior commit (2c9d6c2b871d) attempted to address a use-after-free during disconnect but introduced asymmetry between the usbnet_probe() and usbnet_disconnect() functions. Previously symmetric, probe invoked the bind callback before register_netdev(), while disconnect mirrored this with unregister_netdev() before unbind. The flawed commit reversed the disconnect order, causing issues such as a PHY being stopped twice—once in unbind and again in unregister_netdev—necessitating workarounds in the stop function and complicating PHY handling (CWE-416).
A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N), achieving high impacts on confidentiality, integrity, and availability (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation likely occurs during USB Ethernet adapter disconnect, triggering the use-after-free or related mishandling in unbinding, potentially leading to kernel crashes, arbitrary code execution, or denial of service.
Mitigation involves applying stable kernel patches that revert the problematic commit and restore symmetric binding/unbinding, as detailed in kernel stable repository commits such as 6d5deb242874d924beccf7eb3cef04c1c3b0da79, 969a1b3ea3cb7d58a16fe12fd1b04bfc0ea40509, d1408f6b4dd78fb1b9e26bcf64477984e5f85409, and fbda837107f9bd4ec658d2aa88c6856dba606f06. These changes allow unconditional phy_stop() calls in the stop function, resolving the double-stop issue without needing prior contortions.
Details
- CWE(s)