CVE-2022-50005

HIGH EPSS 10.3%
Published Jun 18, 20251y ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published Jun 18, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout When the pn532 uart device is detaching, the pn532_uart_remove() is called. But there are no functions in pn532_uart_remove() that could delete the cmd_timeout timer, which will cause use-after-free bugs. The process is shown below: (thread 1) | (thread 2) | pn532_uart_send_frame pn532_uart_remove | mod_timer(&pn532->cmd_timeout,...) ... | (wait a time) kfree(pn532) //FREE | pn532_cmd_timeout | pn532_uart_send_frame | pn532->... //USE This patch adds del_timer_sync() in pn532_uart_remove() in order to prevent the use-after-free bugs. What's more, the pn53x_unregister_nfc() is well synchronized, it sets nfc_dev->shutting_down to true and there are no syscalls could restart the cmd_timeout timer.

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
10.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 5

VendorProductVersionRange
linuxlinux_kernel*≥5.5  –  <5.10.140
linuxlinux_kernel*≥5.11  –  <5.15.64
linuxlinux_kernel*≥5.16  –  <5.19.6
linuxlinux_kernel6.0any
linuxlinux_kernel6.0any

References 4

  • git.kernel.org https://git.kernel.org/stable/c/2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/50403ee6daddf0d7a14e9d3b51a377c39a08ec8c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9c34c33893db7a80d0e4b55c23d3b65e29609cfb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/2c71f5d55a86fd5969428abf525c1ae6b1c7b0f5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/50403ee6daddf0d7a14e9d3b51a377c39a08ec8c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/9c34c33893db7a80d0e4b55c23d3b65e29609cfb
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f1e941dbf80a9b8bab0bffbc4cbe41cc7f4c6fb6
    Patch