Use After Free Vulnerability in Tegrakernel from NVIDIA

CVE-2022-50192

What is CVE-2022-50192?

A use-after-free vulnerability exists in the Linux kernel's interaction with the tegra20-slink driver. This issue occurs after the spi_unregister_master() function is called, resulting in the reference count for the master device being reduced to zero, leading to a scenario where the corresponding device data is freed. This mismanagement can be exploited during the device interaction with the tegra20-slink driver, potentially causing instability and security concerns. The vulnerability is mitigated by ensuring that the master is obtained before it is unregistered and released properly only after use.

References