CVE-2022-48822

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48822", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-16T11:38:08.902Z", "datePublished": "2024-07-16T11:44:08.638Z", "dateUpdated": "2026-08-05T08:52:31.008Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:31.008Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: f_fs: Fix use-after-free for epfile\n\nConsider a case where ffs_func_eps_disable is called from\nffs_func_disable as part of composition switch and at the\nsame time ffs_epfile_release get called from userspace.\nffs_epfile_release will free up the read buffer and call\nffs_data_closed which in turn destroys ffs->epfiles and\nmark it as NULL. While this was happening the driver has\nalready initialized the local epfile in ffs_func_eps_disable\nwhich is now freed and waiting to acquire the spinlock. Once\nspinlock is acquired the driver proceeds with the stale value\nof epfile and tries to free the already freed read buffer\ncausing use-after-free.\n\nFollowing is the illustration of the race:\n\n CPU1 CPU2\n\n ffs_func_eps_disable\n epfiles (local copy)\n\t\t\t\t\tffs_epfile_release\n\t\t\t\t\tffs_data_closed\n\t\t\t\t\tif (last file closed)\n\t\t\t\t\tffs_data_reset\n\t\t\t\t\tffs_data_clear\n\t\t\t\t\tffs_epfiles_destroy\nspin_lock\ndereference epfiles\n\nFix this races by taking epfiles local copy & assigning it under\nspinlock and if epfiles(local) is null then update it in ffs->epfiles\nthen finally destroy it.\nExtending the scope further from the race, protecting the ep related\nstructures, and concurrent accesses."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is driven by local FunctionFS epfile close() racing gadget disable/unbind (configfs UDC rewrite or Android USB composition switch), not by USB wire traffic alone; like other f_fs UAFs, reachability is via local VFS/gadget management, which is also the higher-severity vector versus Physical.\nAC:L - The attacker controls both sides by concurrently closing FunctionFS endpoint files while triggering composition switch/UDC unbind from a process they influence, and can retry until the stale epfiles snapshot is used.\nPR:L - Although functionfs lacks FS_USERNS_MOUNT, mounts commonly use uid=/gid=/fmode= to delegate epfile access to non-root gadget daemons (adbd, MTP, USB HAL helpers), so a low-privileged local service account can open/close the vulnerable paths.\nUI:N - The attacker performs the close and composition-switch operations themselves; no separate victim action is required beyond the already-running FunctionFS gadget setup.\nS:U - The use-after-free corrupts host kernel heap state within the same security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The race frees epfile/read_buffer objects while ffs_func_eps_disable still holds a stale pointer and re-enters __ffs_epfile_read_buffer_free, a classic UAF/double-free that heap spraying can turn into arbitrary kernel memory disclosure.\nI:H - UAF/double-free of the epfile array and read_buffer slab objects enables reclaim and corruption of adjacent heap state, yielding arbitrary write and control-flow hijacking primitives under standard UAF exploitation.\nA:H - Dereferencing or double-freeing the destroyed epfile/read_buffer state causes kernel oops/panic even without a full exploit, so availability impact is High for any UAF."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "versions": [{"version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "32048f4be071f9a6966744243f1786f45bb22dc2", "status": "affected", "versionType": "git"}, {"version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "cfe5f6fd335d882bcc829a1c8a7d462a455c626e", "status": "affected", "versionType": "git"}, {"version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "c9fc422c9a43e3d58d246334a71f3390401781dc", "status": "affected", "versionType": "git"}, {"version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "0042178a69eb77a979e36a50dcce9794a3140ef8", "status": "affected", "versionType": "git"}, {"version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "72a8aee863af099d4434314c4536d6c9a61dcf3c", "status": "affected", "versionType": "git"}, {"version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "3e078b18753669615301d946297bafd69294ad2c", "status": "affected", "versionType": "git"}, {"version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "ebe2b1add1055b903e2acd86b290a85297edc0b3", "status": "affected", "versionType": "git"}, {"version": "5cd8f6788ff34999dbd4cbec81a6adfc215e1e60", "status": "affected", "versionType": "git"}, {"version": "4.8.10", "lessThan": "4.9", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "versions": [{"version": "4.9", "status": "affected"}, {"version": "0", "lessThan": "4.9", "status": "unaffected", "versionType": "semver"}, {"version": "4.14.267", "lessThanOrEqual": "4.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "4.19.230", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.180", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.101", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.24", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.10", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.14.267"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "4.19.230"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.4.180"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.10.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.15.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.16.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9", "versionEndExcluding": "5.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.8.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2"}, {"url": "https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e"}, {"url": "https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc"}, {"url": "https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8"}, {"url": "https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c"}, {"url": "https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c"}, {"url": "https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3"}], "title": "usb: f_fs: Fix use-after-free for epfile", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.599Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:57:56.394722Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:12.015Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.599Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T16:57:56.394722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:21.315Z"}}], "cna": {"title": "usb: f_fs: Fix use-after-free for epfile", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The race is driven by local FunctionFS epfile close() racing gadget disable/unbind (configfs UDC rewrite or Android USB composition switch), not by USB wire traffic alone; like other f_fs UAFs, reachability is via local VFS/gadget management, which is also the higher-severity vector versus Physical.\nAC:L - The attacker controls both sides by concurrently closing FunctionFS endpoint files while triggering composition switch/UDC unbind from a process they influence, and can retry until the stale epfiles snapshot is used.\nPR:L - Although functionfs lacks FS_USERNS_MOUNT, mounts commonly use uid=/gid=/fmode= to delegate epfile access to non-root gadget daemons (adbd, MTP, USB HAL helpers), so a low-privileged local service account can open/close the vulnerable paths.\nUI:N - The attacker performs the close and composition-switch operations themselves; no separate victim action is required beyond the already-running FunctionFS gadget setup.\nS:U - The use-after-free corrupts host kernel heap state within the same security authority and does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The race frees epfile/read_buffer objects while ffs_func_eps_disable still holds a stale pointer and re-enters __ffs_epfile_read_buffer_free, a classic UAF/double-free that heap spraying can turn into arbitrary kernel memory disclosure.\nI:H - UAF/double-free of the epfile array and read_buffer slab objects enables reclaim and corruption of adjacent heap state, yielding arbitrary write and control-flow hijacking primitives under standard UAF exploitation.\nA:H - Dereferencing or double-freeing the destroyed epfile/read_buffer state causes kernel oops/panic even without a full exploit, so availability impact is High for any UAF."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "32048f4be071f9a6966744243f1786f45bb22dc2", "versionType": "git"}, {"status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "cfe5f6fd335d882bcc829a1c8a7d462a455c626e", "versionType": "git"}, {"status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "c9fc422c9a43e3d58d246334a71f3390401781dc", "versionType": "git"}, {"status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "0042178a69eb77a979e36a50dcce9794a3140ef8", "versionType": "git"}, {"status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "72a8aee863af099d4434314c4536d6c9a61dcf3c", "versionType": "git"}, {"status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "3e078b18753669615301d946297bafd69294ad2c", "versionType": "git"}, {"status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "lessThan": "ebe2b1add1055b903e2acd86b290a85297edc0b3", "versionType": "git"}, {"status": "affected", "version": "5cd8f6788ff34999dbd4cbec81a6adfc215e1e60", "versionType": "git"}, {"status": "affected", "version": "4.8.10", "lessThan": "4.9", "versionType": "semver"}], "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"status": "unaffected", "version": "0", "lessThan": "4.9", "versionType": "semver"}, {"status": "unaffected", "version": "4.14.267", "versionType": "semver", "lessThanOrEqual": "4.14.*"}, {"status": "unaffected", "version": "4.19.230", "versionType": "semver", "lessThanOrEqual": "4.19.*"}, {"status": "unaffected", "version": "5.4.180", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.101", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.24", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.10", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2"}, {"url": "https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e"}, {"url": "https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc"}, {"url": "https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8"}, {"url": "https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c"}, {"url": "https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c"}, {"url": "https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: f_fs: Fix use-after-free for epfile\n\nConsider a case where ffs_func_eps_disable is called from\nffs_func_disable as part of composition switch and at the\nsame time ffs_epfile_release get called from userspace.\nffs_epfile_release will free up the read buffer and call\nffs_data_closed which in turn destroys ffs->epfiles and\nmark it as NULL. While this was happening the driver has\nalready initialized the local epfile in ffs_func_eps_disable\nwhich is now freed and waiting to acquire the spinlock. Once\nspinlock is acquired the driver proceeds with the stale value\nof epfile and tries to free the already freed read buffer\ncausing use-after-free.\n\nFollowing is the illustration of the race:\n\n CPU1 CPU2\n\n ffs_func_eps_disable\n epfiles (local copy)\n\t\t\t\t\tffs_epfile_release\n\t\t\t\t\tffs_data_closed\n\t\t\t\t\tif (last file closed)\n\t\t\t\t\tffs_data_reset\n\t\t\t\t\tffs_data_clear\n\t\t\t\t\tffs_epfiles_destroy\nspin_lock\ndereference epfiles\n\nFix this races by taking epfiles local copy & assigning it under\nspinlock and if epfiles(local) is null then update it in ffs->epfiles\nthen finally destroy it.\nExtending the scope further from the race, protecting the ep related\nstructures, and concurrent accesses."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.14.267", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.19.230", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.180", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.101", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.24", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.10", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "4.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.8.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:31.008Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48822", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:52:31.008Z", "dateReserved": "2024-07-16T11:38:08.902Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-07-16T11:44:08.638Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "32048f4be071f9a6966744243f1786f45bb22dc2", "status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "versionType": "git"}, {"lessThan": "cfe5f6fd335d882bcc829a1c8a7d462a455c626e", "status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "versionType": "git"}, {"lessThan": "c9fc422c9a43e3d58d246334a71f3390401781dc", "status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "versionType": "git"}, {"lessThan": "0042178a69eb77a979e36a50dcce9794a3140ef8", "status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "versionType": "git"}, {"lessThan": "72a8aee863af099d4434314c4536d6c9a61dcf3c", "status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "versionType": "git"}, {"lessThan": "3e078b18753669615301d946297bafd69294ad2c", "status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "versionType": "git"}, {"lessThan": "ebe2b1add1055b903e2acd86b290a85297edc0b3", "status": "affected", "version": "a9e6f83c2df199187a5248f824f31b6787ae23ae", "versionType": "git"}, {"status": "affected", "version": "5cd8f6788ff34999dbd4cbec81a6adfc215e1e60", "versionType": "git"}, {"lessThan": "4.9", "status": "affected", "version": "4.8.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/usb/gadget/function/f_fs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.9"}, {"lessThan": "4.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.14.*", "status": "unaffected", "version": "4.14.267", "versionType": "semver"}, {"lessThanOrEqual": "4.19.*", "status": "unaffected", "version": "4.19.230", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.180", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.101", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.24", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "55F57F74-D5B8-4F73-8F19-CA80ABA698E0", "versionEndExcluding": "4.14.267", "versionStartIncluding": "4.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "62845903-4271-4AFA-B8B7-6517ED5BFEB2", "versionEndExcluding": "4.19.230", "versionStartIncluding": "4.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6808B38F-AD73-4D55-A158-6EF605E8EB66", "versionEndExcluding": "5.4.180", "versionStartIncluding": "4.20", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A154171E-A3B9-42BE-9E97-C9B0EA43FC54", "versionEndExcluding": "5.10.101", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "866451F0-299E-416C-B0B8-AE6B33E62CCA", "versionEndExcluding": "5.15.24", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "679523BA-1392-404B-AB85-F5A5408B1ECC", "versionEndExcluding": "5.16.10", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: f_fs: Fix use-after-free for epfile\n\nConsider a case where ffs_func_eps_disable is called from\nffs_func_disable as part of composition switch and at the\nsame time ffs_epfile_release get called from userspace.\nffs_epfile_release will free up the read buffer and call\nffs_data_closed which in turn destroys ffs->epfiles and\nmark it as NULL. While this was happening the driver has\nalready initialized the local epfile in ffs_func_eps_disable\nwhich is now freed and waiting to acquire the spinlock. Once\nspinlock is acquired the driver proceeds with the stale value\nof epfile and tries to free the already freed read buffer\ncausing use-after-free.\n\nFollowing is the illustration of the race:\n\n CPU1 CPU2\n\n ffs_func_eps_disable\n epfiles (local copy)\n\t\t\t\t\tffs_epfile_release\n\t\t\t\t\tffs_data_closed\n\t\t\t\t\tif (last file closed)\n\t\t\t\t\tffs_data_reset\n\t\t\t\t\tffs_data_clear\n\t\t\t\t\tffs_epfiles_destroy\nspin_lock\ndereference epfiles\n\nFix this races by taking epfiles local copy & assigning it under\nspinlock and if epfiles(local) is null then update it in ffs->epfiles\nthen finally destroy it.\nExtending the scope further from the race, protecting the ep related\nstructures, and concurrent accesses."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: usb: f_fs: corrige el use-after-free para epfile Considere un caso en el que se llama a ffs_func_eps_disable desde ffs_func_disable como parte del cambio de composici\u00f3n y al mismo tiempo se llama a ffs_epfile_release desde el espacio de usuario. ffs_epfile_release liberar\u00e1 el b\u00fafer de lectura y llamar\u00e1 a ffs_data_closed, que a su vez destruir\u00e1 ffs->epfiles y lo marcar\u00e1 como NULL. Mientras esto suced\u00eda, el controlador ya inicializ\u00f3 el archivo ep local en ffs_func_eps_disable, que ahora est\u00e1 liberado y esperando adquirir el spinlock. Una vez adquirido el spinlock, el controlador contin\u00faa con el valor obsoleto de epfile e intenta liberar el b\u00fafer de lectura ya liberado, lo que provoca un use-after-free. La siguiente es la ilustraci\u00f3n de la ejecuci\u00f3n: CPU1 CPU2 ffs_func_eps_disable epfiles (copia local) ffs_epfile_release ffs_data_closed if (\u00faltimo archivo cerrado) ffs_data_reset ffs_data_clear ffs_epfiles_destroy spin_lock desreferenciar epfiles Arregle estas ejecuci\u00f3ns tomando la copia local de epfiles y asign\u00e1ndola bajo spinlock y si epfiles(local) es null luego actual\u00edcelo en ffs->epfiles y finalmente destr\u00fayalo. Ampliar el alcance m\u00e1s all\u00e1 de la ejecuci\u00f3n, proteger las estructuras relacionadas con ep y los accesos concurrentes."}], "id": "CVE-2022-48822", "lastModified": "2026-08-04T10:17:22.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48822", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T16:57:56.394722Z", "version": "2.0.3"}}]}, "published": "2024-07-16T12:15:06.073", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0042178a69eb77a979e36a50dcce9794a3140ef8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/32048f4be071f9a6966744243f1786f45bb22dc2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e078b18753669615301d946297bafd69294ad2c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/72a8aee863af099d4434314c4536d6c9a61dcf3c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c9fc422c9a43e3d58d246334a71f3390401781dc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/cfe5f6fd335d882bcc829a1c8a7d462a455c626e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ebe2b1add1055b903e2acd86b290a85297edc0b3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: usb: f_fs: Fix use-after-free for epfile", "id": "2298161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2298161"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nusb: f_fs: Fix use-after-free for epfile\nConsider a case where ffs_func_eps_disable is called from\nffs_func_disable as part of composition switch and at the\nsame time ffs_epfile_release get called from userspace.\nffs_epfile_release will free up the read buffer and call\nffs_data_closed which in turn destroys ffs->epfiles and\nmark it as NULL. While this was happening the driver has\nalready initialized the local epfile in ffs_func_eps_disable\nwhich is now freed and waiting to acquire the spinlock. Once\nspinlock is acquired the driver proceeds with the stale value\nof epfile and tries to free the already freed read buffer\ncausing use-after-free.\nFollowing is the illustration of the race:\nCPU1 CPU2\nffs_func_eps_disable\nepfiles (local copy)\nffs_epfile_release\nffs_data_closed\nif (last file closed)\nffs_data_reset\nffs_data_clear\nffs_epfiles_destroy\nspin_lock\ndereference epfiles\nFix this races by taking epfiles local copy & assigning it under\nspinlock and if epfiles(local) is null then update it in ffs->epfiles\nthen finally destroy it.\nExtending the scope further from the race, protecting the ep related\nstructures, and concurrent accesses."], "name": "CVE-2022-48822", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-07-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48822\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48822\nhttps://lore.kernel.org/linux-cve-announce/2024071650-CVE-2022-48822-48d1@gregkh/T"], "threat_severity": "Low"}

{}