Use-After-Free in USB Ethernet Drivers in Linux Kernel

CVE-2022-50220

What is CVE-2022-50220?

In the Linux kernel, a use-after-free vulnerability affects USB Ethernet drivers due to improper handling of device disconnection events. When a link change interrupt occurs just before a device is disconnected, it may trigger a sequence leading to operations on an already unregistered network device. Specifically, as usbnet_deferred_kevent() is awaited post-unregistration, subsequent operations such as netif_carrier_on/off can be executed on freed memory, resulting in potential system instability and security risks. This vulnerability highlights the importance of careful resource management in driver development.

References