Use-After-Free Vulnerability in Linux Kernel Related to fsl_mc_bus Device Management

CVE-2022-49711

Summary

A use-after-free vulnerability has been identified in the Linux kernel, specifically within the fsl-mc-bus device management code. The issue arises in the fsl_mc_bus_remove() function, where a reference to a freed device is used, potentially leading to memory corruption. This can occur since mc->root_mc_bus_dev is deallocated in fsl_mc_device_remove(), resulting in accessing mc->root_mc_bus_dev->mc_io after it has been released. The vulnerability is addressed by storing a reference to mc->root_mc_bus_dev->mc_io in a temporary variable before it is passed to fsl_destroy_mc_io(), thus preventing access to invalid memory locations. The current patch needs to be adapted for use in kernel versions older than 5.15.

References