CVE-2022-49755

usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait

High · published March 27, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
13.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait

While performing fast composition switch, there is a possibility that the

process of ffs_ep0_write/ffs_ep0_read get into a race condition

due to ep0req being freed up from functionfs_unbind.

Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait

by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't

bounded so it can go ahead and mark the ep0req to NULL, and since there

is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.

Fix this by making a serialized execution between the two functions using

a mutex_lock(ffs->mutex).

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.3th percentile
Published
2025-03-27T16:43Z
EPSS history
Timeline
  • 27 MAR 16:43Z
    usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
    cvelistv5