CVE-2022-50745

Vulnerability

Description

In the Linux kernel's staging media driver tegra-video, a use-after-free vulnerability exists in the device_node handling within the Tegra CSI (Camera Serial Interface) initialization path [1]. The root cause is a missing of_node_get() call when storing a pointer to a device tree node. During probe, the function tegra_csi_channels_alloc iterates over child nodes using for_each_child_of_node, which automatically takes and releases a reference to each node. The pointer to the node is saved into chan->of_node without incrementing its reference count. Once the loop iteration completes, the node's reference count drops to zero and it can be freed [2].

Exploitation

An attacker with the ability to load or influence the behavior of the tegra-video driver could exploit this flaw. The use-after-free condition occurs when the driver later calls tegra_csi_channels_init, which accesses the freed chan->of_node pointer [1]. Exploitation requires local access to the system and the ability to trigger the probe sequence of the Tegra CSI driver. While the race window is narrow, a successful trigger could result in memory corruption.

Impact

A successful exploitation of this use-after-free could lead to a denial of service (system crash) or, potentially, local privilege escalation if an attacker can manipulate the freed memory to control execution flow [2]. The vulnerability affects systems using the Tegra video driver in the Linux kernel.

Mitigation

The fix involves adding an of_node_get() call when storing the node pointer and an of_node_put() during driver teardown to ensure proper reference counting [1][2]. The patch has been applied to the stable kernel tree. Users should update their kernel to a version containing this fix. The vulnerability is rated as having a moderate severity due to the local access requirement and the need for specific hardware.