Use-After-Free Vulnerability in Linux Kernel's bcd2000 Driver by The Linux Foundation

CVE-2022-50229

What is CVE-2022-50229?

A use-after-free vulnerability exists in the bcd2000 driver within the Linux kernel, which occurs when the driver encounters an error during the probing phase. If the snd_card_register() function fails, the driver improperly frees the 'bcd2k->midi_out_urb' before terminating it, leading to potential security risks. Properly addressing this issue requires reversing the order of operations by invoking usb_kill_urb() prior to calling usb_free_urb(), thus securing the driver against unintended accesses to freed memory resources.

References