In the Linux kernel, the following vulnerability has been resolved:
nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
When the pn532 uart device is detaching, the pn532_uart_remove()
is called. But there are no functions in pn532_uart_remove() that
could delete the cmd_timeout timer, which will cause use-after-free
bugs. The process is shown below:
(thread 1) | (thread 2)
| pn532_uart_send_frame
pn532_uart_remove | mod_timer(&pn532->cmd_timeout,...)
... | (wait a time)
kfree(pn532) //FREE | pn532_cmd_timeout
| pn532_uart_send_frame
| pn532->... //USE
This patch adds del_timer_sync() in pn532_uart_remove() in order to
prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc()
is well synchronized, it sets nfc_dev->shutting_down to true and there
are no syscalls could restart the cmd_timeout timer.
References
Configurations
Configuration 1 (hide)
|
History
14 Nov 2025, 16:51
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:* |
|
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| References | () https://git.kernel.org/stable/c/2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5 - Patch | |
| References | () https://git.kernel.org/stable/c/50403ee6daddf0d7a14e9d3b51a377c39a08ec8c - Patch | |
| References | () https://git.kernel.org/stable/c/9c34c33893db7a80d0e4b55c23d3b65e29609cfb - Patch | |
| References | () https://git.kernel.org/stable/c/f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6 - Patch |
Information
Published : 2025-06-18 11:15
Updated : 2025-11-14 16:51
NVD link : CVE-2022-50005
Mitre link : CVE-2022-50005
CVE.ORG link : CVE-2022-50005
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free