CVE-2022-50740
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that usb_get_urb() is called but usb_free_urb() (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or urb->ep fields have not been initialized and usb_kill_urb() returns immediately. The patch removes trying to kill urbs located in hif_dev->tx.tx_buf because hif_dev->tx.tx_buf is not supposed to contain urbs which are in pending state (the pending urbs are stored in hif_dev->tx.tx_pending). The tx.tx_lock is acquired so there should not be any changes in the list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
How to fix
- Linux Linux134ae5eba41294eff76e4be20d6001b8f0192207, 472312fef2b9eccaa03bd59e0ab2527da945e736, eddbb8f7620f9f8008b090a6e10c460074ca575a, 9850791d389b342ae6e573fe8198db0b4d338352, c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d, d856f7574bcc1d81de565a857caf32f122cd7ce0, c05189a429fdb371dd455c3c466d67ac2ebff152, 08aa0537ec8cf29ceccae98acc1a534fc12598c1, c2a94de38c74e86f49124ac14f093d6a5c377a90, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 4.5, 5.9, 5.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 6f0706ef39fecc6bf56d67728fe0c94e26b43e9d ≤ v < 134ae5eba41294eff76e4be20d6001b8f0192207, 795d57a558d106b8a5bc2bd7aeaf707d9a099244 ≤ v < 472312fef2b9eccaa03bd59e0ab2527da945e736, df4318440c1568b7dedc5f7d4e617d0e297a1313 ≤ v < eddbb8f7620f9f8008b090a6e10c460074ca575a, a9990ed2d7ca9339d37c7f67d6f5cb298c3f1b34 ≤ v < 9850791d389b342ae6e573fe8198db0b4d338352, 03fb92a432ea5abe5909bca1455b7e44a9380480 ≤ v < c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d, 03fb92a432ea5abe5909bca1455b7e44a9380480 ≤ v < d856f7574bcc1d81de565a857caf32f122cd7ce0, 03fb92a432ea5abe5909bca1455b7e44a9380480 ≤ v < c05189a429fdb371dd455c3c466d67ac2ebff152, 03fb92a432ea5abe5909bca1455b7e44a9380480 ≤ v < 08aa0537ec8cf29ceccae98acc1a534fc12598c1, 03fb92a432ea5abe5909bca1455b7e44a9380480 ≤ v < c2a94de38c74e86f49124ac14f093d6a5c377a90, b92e116ae36f498858dbb18e29a066c3f5348965, 7f5972267295fe49f8da8eb42bc2eb3d140860c0, 2d72d5ce63c92f56b9f978e8befb5838144176b9, 4.9.241 ≤ v < 4.9.337, 4.14.203 ≤ v < 4.14.303, 4.19.154 ≤ v < 4.19.270, 5.4.73 ≤ v < 5.4.229, 4.4.241 ≤ v < 4.5, 5.8.17 ≤ v < 5.9, 5.9.2 ≤ v < 5.10, 5.10 | 134ae5eba41294eff76e4be20d6001b8f0192207, 472312fef2b9eccaa03bd59e0ab2527da945e736, eddbb8f7620f9f8008b090a6e10c460074ca575a, 9850791d389b342ae6e573fe8198db0b4d338352, c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d, d856f7574bcc1d81de565a857caf32f122cd7ce0, c05189a429fdb371dd455c3c466d67ac2ebff152, 08aa0537ec8cf29ceccae98acc1a534fc12598c1, c2a94de38c74e86f49124ac14f093d6a5c377a90, 4.9.337, 4.14.303, 4.19.270, 5.4.229, 4.5, 5.9, 5.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.