CVE-2022-49755

Summary

CVE-2022-49755 is a vulnerability affecting the Linux kernel's USB gadget's fast composition switch mechanism (ffs). During this switch, a race condition may occur between the functions ffs_ep0_write/ffs_ep0_read and functionfs_unbind. If ffs_ep0_write takes a lock and then functionfs_unbind marks ep0req as NULL before the check in ffs_ep0_queue_wait, a use-after-free situation will ensue, leading to potential memory corruption and security vulnerabilities. The issue is addressed by implementing a mutex lock on ffs->mutex to ensure serialized execution between these functions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.