CVE-2022-50785

Vulnerability

Analysis

The vulnerability resides in the FSI (Flexible Support Interface) OCC (On-Chip Controller) driver within the Linux kernel. The root cause is insufficient device lifecycle management: the driver failed to properly increment and decrement the device's reference count using get_device and put_device during file descriptor open and close operations [1]. This oversight means a device could be freed from memory while a user-space file descriptor still holds a reference to it, leading to a use-after-free condition. Additionally, the driver lacked proper locking when freeing the device's internal buffer and did not validate the buffer's existence before using it in the submit function [1].

Exploitation

Conditions

To exploit this vulnerability, an attacker would require local access to the system and the ability to open a file descriptor on the FSI OCC device (e.g., /dev/occ). The attack scenario involves keeping a file descriptor open while triggering device removal (e.g., via hot-unplug or driver unbind), causing the kernel to free the device structure. Subsequent operations on the dangling file descriptor—such as an IOCTL submit call—would then access freed memory [1]. No authentication beyond local user access to the device node is needed.

Impact

A successful exploit could allow a local attacker to cause a denial of service (system crash or memory corruption) or potentially escalate privileges, if the freed memory is repurposed and controlled. The use-after-free in the OCC driver could lead to arbitrary code execution in kernel context, though the primary impact cited is memory safety [1].

Mitigation

Status

This vulnerability is patched in the Linux kernel. The fix adds proper get_device/put_device calls in the open and close functions, locks around buffer freeing, and a NULL check before using the buffer in the submit function [1]. Users should update to a kernel version containing the commit 3593e8efc9f0dac6be70bd5c964eadaa86bf2713 or later [1]. No workaround is available without patching.